CVE-2026-49271: libheif Integer Overflow in HEIF Decoder Causes Denial of Service

Technical summary

The vulnerability stems from insufficient bounds checking in the uncompressed HEIF decoder's validation logic. Specifically, when validating icef (image collection entry) compressed-unit offsets, the code performs an addition (unit_offset + unit_size) to check if the offset falls within acceptable bounds. Because both operands are unsigned integers, this addition can overflow and wrap around, allowing a crafted offset to pass validation despite pointing outside the compressed item buffer. Once validation passes, the library constructs a C++ vector using iterators derived from this out-of-bounds memory region, triggering a heap read violation. The flaw is classified as out-of-bounds read (CWE-125).

Business impact

Any software or service that processes user-supplied HEIF or AVIF images and relies on libheif faces denial-of-service risk. In web contexts, this could impact image processing pipelines, content delivery systems, and user-facing applications. A crash during image processing may disrupt workflows, degrade service availability, or trigger unexpected error states. While the CVSS score reflects medium severity (no confidentiality or integrity impact in the baseline), the attack surface is broad given the ubiquity of HEIF/AVIF adoption and the low barrier to exploitation—users may unknowingly open a crafted image file.

Affected systems

All applications and libraries embedding struktur libheif prior to version 1.22.1 are affected. This includes image viewers, web browsers with HEIF support, media players, content management systems, and cloud storage platforms that process user images. Mobile applications and server-side image processing services are equally at risk. Check your software bill of materials (SBOM) and dependency manifests to identify libheif versions in use.

Exploitability

Exploitation requires user interaction—opening or processing a crafted HEIF file. No authentication or special system privileges are required. An attacker can distribute the malicious file via email, messaging platforms, or web uploads. The integer wraparound condition is deterministic and triggered on any vulnerable version; no advanced reverse engineering is needed to craft a proof-of-concept. However, reliable exploitation to leak sensitive data would require additional conditions; the primary impact is crash-based denial of service.

Remediation

Upgrade libheif to version 1.22.1 or later. For applications that bundle libheif, coordinate with upstream maintainers or rebuild from patched source. If immediate patching is not feasible, consider disabling HEIF/AVIF processing or restricting image uploads to trusted sources pending remediation. Test patched deployments with benign HEIF samples to confirm functionality.

Patch guidance

The patch in version 1.22.1 corrects the bounds-checking logic to prevent integer overflow. Verify the patch by reviewing the official struktur libheif repository (GitHub: strukturag/libheif) and confirming the release notes reference this CVE. When deploying patches: (1) prioritize systems exposed to untrusted image uploads; (2) perform regression testing on image processing workflows; (3) update SBOM records; (4) communicate patch status to dependent applications.

Detection guidance

Monitor for crashes or exceptions in libheif processing with error messages related to 'out-of-bounds' or 'vector iterator'. Web application firewalls and intrusion detection systems can flag suspiciously crafted HEIF headers (e.g., unit_offset + unit_size values that suggest wraparound). In production, enable logging for image processing errors and anomalies. Forensic analysis of crash dumps may show heap corruption or memory access violations. Proactive scanning of image files in queues can identify malformed HEIF structures before processing.

Why prioritize this

Prioritize this vulnerability for systems processing untrusted images (web services, user-facing applications) or where availability is critical. The medium CVSS score reflects limited direct impact (denial of service only), but the broad attack surface—any HEIF/AVIF consumer—and ease of exploitation elevate practical risk. Organizations with strict security postures should patch within standard update cycles; those managing public-facing image pipelines should consider expedited patching.

Risk score, explained

CVSS 3.1 score of 6.5 (MEDIUM) reflects: high attack vector (network), low attack complexity, no privilege requirement, and user interaction required (opening the file). The impact is limited to availability (crash), with no confidentiality or integrity loss in the base case. The score is appropriate for a denial-of-service flaw that requires user action but affects many deployments. Contextual risk may be higher in high-availability systems or scenarios where image processing is mission-critical.

Frequently asked questions