CVE-2026-41069 Details
Description
libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, a malformed HEIF sequence file can trigger an out-of-bounds read in core sequence parsing logic, causing DoS. A malformed file can have stco.entry_count == 0 (creating no chunks) while still passing validation because saio.entry_count == 0 matches, but with saiz.sample_count > 0 the SampleAuxInfoReader constructor still enters its loop. This leads to an out-of-bounds dereference on the empty chunks[0] in chunked mode.
A vulnerability in libheif versions through 1.21.2 allows a malformed HEIF sequence file to cause an out-of-bounds read in the core sequence parsing logic. This flaw can lead to a denial-of-service condition by crashing the application. The issue arises when a file's stco.entry_count is zero, creating no chunks, while the saio.entry_count also equals zero, allowing the file to pass validation. However, with a positive saiz.sample_count, the SampleAuxInfoReader constructor improperly processes the file, resulting in an out-of-bounds dereference on an empty chunk vector.
Users can upgrade to libheif version 1.22.0 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/strukturag/libheif/security/advisories/GHSA-p82x-fpmv-576r | CISA-ADP | ExploitVendor Advisory |
| https://github.com/strukturag/libheif/releases/tag/v1.22.0 | [email protected] | ProductRelease Notes |
| https://github.com/strukturag/libheif/security/advisories/GHSA-p82x-fpmv-576r | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
| CWE-476 | NULL Pointer Dereference | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| struktur libheif | < 1.22.0 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 27, 2026 | Initial Analysis | [email protected] |
| May 26, 2026 | CVE Modified | CISA-ADP |
| May 22, 2026 | New CVE Received | [email protected] |