CVE-2026-47254

libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, Track::init_sample_timing_table() in libheif/sequences/track.cc stores an out-of-bounds chunk index (m_chunks.size()) into m_presentation_timeline when the number of chunks defined in the stco box is less than the number of samples in stsz. A subsequent call to heif_track_get_next_raw_sequence_sample() reads m_chunks[chunk_idx] with that OOB index, causing a heap-buffer-overflow. Version 1.22.0 fixes the issue.

These are all security issues fixed in the gdk-pixbuf-loader-libheif-1.22.2-1.1 package on the GA media of openSUSE Tumbleweed.

This update for libheif fixes the following issues

Update to 1.23.0:

• CVE-2025-68431: heap buffer over-read in HeifPixelImage: overlay() via crafted HEIF that exercises the overlay image item (bsc#1255735).

• CVE-2026-3949: manipulation of the argument size of a malicious frame can lead to out-of-bounds read (bsc#1259541).

• CVE-2026-3950: manipulation of the component stsz/stts can lead to out-of-bounds read (bsc#1259544).

• CVE-2026-32738: Heap OOB Read / SEGV Crash via Zero samples_per_chunk in stsc (bsc#1265874).

• CVE-2026-32739: Infinite Loop DoS in stts Sample Duration Lookup (bsc#1265875).

• CVE-2026-32740: Heap-Buffer-Overflow Write in Grid Tile Chroma Compositing (bsc#1265876).

• CVE-2026-32741: heap buffer overflow in decode_mask_image() (bsc#1265877).

• CVE-2026-32814: Uninitialized Heap Memory Information Leak via Failed Grid Tiles (bsc#1265878).

• CVE-2026-32882: Heap Buffer OOB Read in overlay compositing due to wrong alpha stride (bsc#1265879).

• CVE-2026-41069: Out-of-bounds vector access leading to invalid dereference (bsc#1265979).

• CVE-2026-41071: Heap buffer over-read in SampleAuxInfoReader via crafted HEIF sequence file with mismatched saiz sample count (bsc#1265980).

• CVE-2026-47178: Heap Out Of Bounds Write in unci subsystem (bsc#1265981).

• CVE-2026-47247: Heap Information Disclosure via Grid Image Gap + Uninitialized Pixel Plane Allocation (bsc#1265982).

• CVE-2026-47251: integer overflow bypass in vvdec_push_data2 (bsc#1265983).

• CVE-2026-47254: Heap Buffer Overflow in Track: get_next_sample_raw_data() -- OOB Chunk Vector Access (bsc#1265987).

• CVE-2026-47709: NULL pointer dereference in heif_image_handle_get_image_tiling for malformed unci image missing ispe (bsc#1265988).

• CVE-2026-47714: Integer overflow in inline mask size calculation causes undersized buffer allocation (bsc#1265989).

• CVE-2026-48029: heap OOB read in ImageItem_Grid: decode_grid_tile via irot-induced tile-coordinate underflow (bsc#1265990).

• CVE-2026-49271: Wrapped icef compressed-unit range check causes out-of-bounds read in uncompressed HEIF decoder (bsc#1266282).

• CVE-2026-50142: unbounded heap allocation in HEIF sequence parser (bsc#1267455).

• Heap buffer overflow via uint32_t stride overflow in image plane allocation (+ 2 additional instances) (bsc#1265997).

• Incorrect byte-count initialization in BitstreamRange constructor allows container-boundary check bypass (bsc#1265995).

• Integer Overflow in SampleAuxInfoReader Offset Calculation (bsc#1265992).

• Out-of-bounds read and assertion-based DoS in EXIF parsing (find_exif_tag / read32) with short EXIF TIFF payload (bsc#1265996).

• Out-of-bounds write in inline mask region API when source mask exceeds declared region (bsc#1266281).

• update to 1.23.0:

• add API functions to read and write metadata: ambient viewing environment nominal diffuse white luminance

• update to 1.22.2:

• adds a output_image_nclx_profile_passthrough option to heif_decoding_options
• build issues with OpenJPEG plugin (#1813)
• non-plain C in header (#1812)

• update to 1.22.0:

• This is a large release with substantial new functionality, mainly focusing on generalized image formats (e.g., multi- spectral images) and a reworked implementation of ISO/IEC 23001-17 (lossless image codec).
• HDR up to 64 bpp
• Multi-component images with arbitrary component layouts (multi-spectral images, arbitrary non-visual data)
• Filter-array (Bayer / mosaic) images, with debayering in color transformation pipeline
• Metadata: chroma-sample location (cloc), sample non- uniformity (snuc), sensor bad-pixel map (sbpm), polarization pattern (splz)
• heif-dec can now convert to WebP (thanks to @torusrxxx).
• heif-enc can now accept input from WebP, HEIF, pure raw files (including floating point pixel data), and CMYK JPEG (converted to RGB).
• TIFF input can now read many TIFF formats used in geospatial imaging, like: 16-bit, signed integers, float samples, tiled TIFFs,…

This update for libheif fixes the following issues

Update to 1.23.0:

• CVE-2025-68431: heap buffer over-read in HeifPixelImage: overlay() via crafted HEIF that exercises the overlay image item (bsc#1255735).

• CVE-2026-3949: manipulation of the argument size of a malicious frame can lead to out-of-bounds read (bsc#1259541).

• CVE-2026-3950: manipulation of the component stsz/stts can lead to out-of-bounds read (bsc#1259544).

• CVE-2026-32738: Heap OOB Read / SEGV Crash via Zero samples_per_chunk in stsc (bsc#1265874).

• CVE-2026-32739: Infinite Loop DoS in stts Sample Duration Lookup (bsc#1265875).

• CVE-2026-32740: Heap-Buffer-Overflow Write in Grid Tile Chroma Compositing (bsc#1265876).

• CVE-2026-32741: heap buffer overflow in decode_mask_image() (bsc#1265877).

• CVE-2026-32814: Uninitialized Heap Memory Information Leak via Failed Grid Tiles (bsc#1265878).

• CVE-2026-32882: Heap Buffer OOB Read in overlay compositing due to wrong alpha stride (bsc#1265879).

• CVE-2026-41069: Out-of-bounds vector access leading to invalid dereference (bsc#1265979).

• CVE-2026-41071: Heap buffer over-read in SampleAuxInfoReader via crafted HEIF sequence file with mismatched saiz sample count (bsc#1265980).

• CVE-2026-47178: Heap Out Of Bounds Write in unci subsystem (bsc#1265981).

• CVE-2026-47247: Heap Information Disclosure via Grid Image Gap + Uninitialized Pixel Plane Allocation (bsc#1265982).

• CVE-2026-47251: integer overflow bypass in vvdec_push_data2 (bsc#1265983).

• CVE-2026-47254: Heap Buffer Overflow in Track: get_next_sample_raw_data() -- OOB Chunk Vector Access (bsc#1265987).

• CVE-2026-47709: NULL pointer dereference in heif_image_handle_get_image_tiling for malformed unci image missing ispe (bsc#1265988).

• CVE-2026-47714: Integer overflow in inline mask size calculation causes undersized buffer allocation (bsc#1265989).

• CVE-2026-48029: heap OOB read in ImageItem_Grid: decode_grid_tile via irot-induced tile-coordinate underflow (bsc#1265990).

• CVE-2026-49271: Wrapped icef compressed-unit range check causes out-of-bounds read in uncompressed HEIF decoder (bsc#1266282).

• CVE-2026-50142: unbounded heap allocation in HEIF sequence parser (bsc#1267455).

• Heap buffer overflow via uint32_t stride overflow in image plane allocation (+ 2 additional instances) (bsc#1265997).

• Incorrect byte-count initialization in BitstreamRange constructor allows container-boundary check bypass (bsc#1265995).

• Integer Overflow in SampleAuxInfoReader Offset Calculation (bsc#1265992).

• Out-of-bounds read and assertion-based DoS in EXIF parsing (find_exif_tag / read32) with short EXIF TIFF payload (bsc#1265996).

• Out-of-bounds write in inline mask region API when source mask exceeds declared region (bsc#1266281).

• update to 1.23.0:

• add API functions to read and write metadata: ambient viewing environment nominal diffuse white luminance

• update to 1.22.2:

• adds a output_image_nclx_profile_passthrough option to heif_decoding_options
• build issues with OpenJPEG plugin (#1813)
• non-plain C in header (#1812)

• update to 1.22.0:

• This is a large release with substantial new functionality, mainly focusing on generalized image formats (e.g., multi- spectral images) and a reworked implementation of ISO/IEC 23001-17 (lossless image codec).
• HDR up to 64 bpp
• Multi-component images with arbitrary component layouts (multi-spectral images, arbitrary non-visual data)
• Filter-array (Bayer / mosaic) images, with debayering in color transformation pipeline
• Metadata: chroma-sample location (cloc), sample non- uniformity (snuc), sensor bad-pixel map (sbpm), polarization pattern (splz)
• heif-dec can now convert to WebP (thanks to @torusrxxx).
• heif-enc can now accept input from WebP, HEIF, pure raw files (including floating point pixel data), and CMYK JPEG (converted to RGB).
• TIFF input can now read many TIFF formats used in geospatial imaging, like: 16-bit, signed integers, float samples, tiled TIFFs,…

This update for libheif fixes the following issues

Update to 1.23.0:

• CVE-2025-68431: heap buffer over-read in HeifPixelImage: overlay() via crafted HEIF that exercises the overlay image item (bsc#1255735).
• CVE-2026-3950: manipulation of the component stsz/stts can lead to out-of-bounds read (bsc#1259544).
• CVE-2026-32738: Heap OOB Read / SEGV Crash via Zero samples_per_chunk in stsc (bsc#1265874).
• CVE-2026-32739: Infinite Loop DoS in stts Sample Duration Lookup (bsc#1265875).
• CVE-2026-32740: Heap-Buffer-Overflow Write in Grid Tile Chroma Compositing (bsc#1265876).
• CVE-2026-32741: heap buffer overflow in decode_mask_image() (bsc#1265877).
• CVE-2026-32814: Uninitialized Heap Memory Information Leak via Failed Grid Tiles (bsc#1265878).
• CVE-2026-32882: Heap Buffer OOB Read in overlay compositing due to wrong alpha stride (bsc#1265879).
• CVE-2026-41069: Out-of-bounds vector access leading to invalid dereference (bsc#1265979).
• CVE-2026-41071: Heap buffer over-read in SampleAuxInfoReader via crafted HEIF sequence file with mismatched saiz sample count (bsc#1265980).
• CVE-2026-47178: Heap Out Of Bounds Write in unci subsystem (bsc#1265981).
• CVE-2026-47247: Heap Information Disclosure via Grid Image Gap + Uninitialized Pixel Plane Allocation (bsc#1265982).
• CVE-2026-47251: integer overflow bypass in vvdec_push_data2 (bsc#1265983).
• CVE-2026-47254: Heap Buffer Overflow in Track: get_next_sample_raw_data() -- OOB Chunk Vector Access (bsc#1265987).
• CVE-2026-47709: NULL pointer dereference in heif_image_handle_get_image_tiling for malformed unci image missing ispe (bsc#1265988).
• CVE-2026-47714: Integer overflow in inline mask size calculation causes undersized buffer allocation (bsc#1265989).
• CVE-2026-48029: heap OOB read in ImageItem_Grid: decode_grid_tile via irot-induced tile-coordinate underflow (bsc#1265990).
• CVE-2026-49271: Wrapped icef compressed-unit range check causes out-of-bounds read in uncompressed HEIF decoder (bsc#1266282).
• CVE-2026-50142: unbounded heap allocation in HEIF sequence parser (bsc#1267455).
• Heap buffer overflow via uint32_t stride overflow in image plane allocation (+ 2 additional instances) (bsc#1265997).
• Incorrect byte-count initialization in BitstreamRange constructor allows container-boundary check bypass (bsc#1265995).
• Integer Overflow in SampleAuxInfoReader Offset Calculation (bsc#1265992).
• Out-of-bounds read and assertion-based DoS in EXIF parsing (find_exif_tag / read32) with short EXIF TIFF payload (bsc#1265996).
• Out-of-bounds write in inline mask region API when source mask exceeds declared region (bsc#1266281).

Changes for libheif:

• version update to 1.23.0:

• add API functions to read and write metadata: ambient viewing environment nominal diffuse white luminance
• adds a output_image_nclx_profile_passthrough option to heif_decoding_options
• CVE-2026-50142 (GHSA-jvmp-j3cw-84mh) - unbounded heap allocation in HEIF sequence parser (stsz fixed-size mode missing bound check)

• version update to 1.22.2:

• build issues with OpenJPEG plugin (#1813)
• non-plain C in header (#1812)
• CVE-2026-49271 (GHSA-r7qj-cg5r-r6vf) - Wrapped icef compressed-unit range check causes out-of-bounds read in uncompressed HEIF decoder
• CVE TBD (GHSA-5hqq-636x-r3cr) - Out-of-bounds write in inline mask region API when source mask exceeds declared region

• update to 1.22.0:

• This is a large release with substantial new functionality, mainly focusing on generalized image formats (e.g., multi- spectral images) and a reworked implementation of ISO/IEC 23001-17 (lossless image codec).
• HDR up to 64 bpp
• Multi-component images with arbitrary component layouts (multi-spectral images, arbitrary non-visual data)
• Filter-array (Bayer / mosaic) images, with debayering in color transformation pipeline
• Metadata: chroma-sample location (cloc), sample non- uniformity (snuc), sensor bad-pixel map (sbpm), polarization pattern (splz)
• heif-dec can…

Xianrui Dong discovered that libheif had an out-of-bounds read in its HEIF sequence track parser. An attacker could possibly use this issue to cause a denial of service or obtain sensitive information. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-47254)

Junyi Liu discovered that libheif had a null pointer dereference in its image tiling interface. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-47709)

Calvin Young and Enoch Chow discovered that libheif had an integer overflow in its inline mask size calculation. An attacker could possibly use this issue to cause a denial of service or obtain sensitive information. (CVE-2026-47714)

Ariel Koren discovered that libheif had an integer underflow in its grid image tile coordinate transform. An attacker could possibly use this issue to cause a denial of service or obtain sensitive information. (CVE-2026-48029)

It was discovered that libheif had a missing bound check in its HEIF sequence parser, allowing unbounded heap allocation. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-50142)