CVE-2026-41069: libheif allows Out-of-bounds vector access leading to invalid dereference (DoS)
Last updated 19 June 2026
Other sources
libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, a malformed HEIF sequence file can trigger an out-of-bounds read in core sequence parsing logic, causing DoS. A malformed file can have stco.entrycount == 0 (creating no chunks) while still passing validation because saio.entrycount == 0 matches, but with saiz.samplecount > 0 the SampleAuxInfoReader constructor still enters its loop. This leads to an out-of-bounds dereference on the empty chunks[0] in chunked mode.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
libheifto a version that resolves this vulnerability.Fixed in 1.21.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41069?
The severity of CVE-2026-41069 is medium with a score of 6.5.
How do I fix CVE-2026-41069?
To fix CVE-2026-41069, upgrade to libheif version 1.22.0 or later.
What does CVE-2026-41069 affect?
CVE-2026-41069 affects libheif, a HEIF and AVIF file format decoder and encoder.
What type of vulnerability is CVE-2026-41069?
CVE-2026-41069 is an out-of-bounds vector access vulnerability that can lead to a denial-of-service condition.
What can trigger CVE-2026-41069?
CVE-2026-41069 can be triggered by a malformed HEIF sequence file with stco.entry_count set to 0.