CVE-2025-68431 | THREATINT

Description

libheif is an HEIF and AVIF file format decoder and encoder. Prior to version 1.21.0, a crafted HEIF that exercises the overlay image item path triggers a heap buffer over-read in `HeifPixelImage::overlay()`. The function computes a negative row length (likely from an unclipped overlay rectangle or invalid offsets), which then underflows when converted to `size_t` and is passed to `memcpy`, causing a very large read past the end of the source plane and a crash. Version 1.21.0 contains a patch. As a workaround, avoid decoding images using `iovl` overlay boxes.

PUBLISHED Reserved 2025-12-17 | Published 2025-12-29 | Updated 2025-12-30 | Assigner GitHub_M

MEDIUM: 6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Problem types

CWE-125: Out-of-bounds Read

CWE-190: Integer Overflow or Wraparound

Product status

< 1.21.0

affected

References

github.com/...ibheif/security/advisories/GHSA-j87x-4gmq-cqfq

github.com/...ommit/b8c12a7b70f46c9516711a988483bed377b78d46

github.com/strukturag/libheif/releases/tag/v1.21.0

cve.org (CVE-2025-68431)

nvd.nist.gov (CVE-2025-68431)

Download JSON