CVE-2026-41071: libheif: Heap buffer over-read in SampleAuxInfoReader via crafted HEIF sequence file with mismatched saiz sample count
Last updated 19 June 2026
Other sources
libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, a crafted HEIF sequence file where the saiz box declares more samples than actually exist in the track's chunk table causes a heap-buffer-overflow (out-of-bounds read) in the SampleAuxInfoReader constructor. The SampleAuxInfoReader constructor iterates over saiz->getnumsamples() samples but doesn't validate that this count is consistent with the number of chunks in the chunks vector. When saiz declares more samples than the chunks cover, the loop increments currentchunk past chunks.size(), causing an out-of-bounds read on the chunks vector. The vulnerability is triggered during file parsing (heifcontextreadfromfile) without any additional user interaction. Any application using libheif to open untrusted HEIF files is affected. This issue has been fixed in version 1.22.0.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
libheifto a version that resolves this vulnerability.Fixed in 1.22.0 - Compensating control
If you must process untrusted HEIF/AVIF files, restrict exposure by isolating the parsing/decoding process (e.g., run it in a sandbox/container) since the vulnerability is triggered during file parsing (heif_context_read_from_file) without additional user interaction.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41071?
CVE-2026-41071 has a risk score of 43, indicating a significant vulnerability.
How do I fix CVE-2026-41071?
To mitigate CVE-2026-41071, update libheif to version 1.22.0 or later.
What type of vulnerability is CVE-2026-41071?
CVE-2026-41071 is classified as a heap buffer over-read vulnerability affecting libheif.
What causes CVE-2026-41071?
CVE-2026-41071 is triggered by a crafted HEIF sequence file with a mismatched saiz sample count.
In which versions of libheif is CVE-2026-41071 found?
CVE-2026-41071 affects libheif versions 1.21.2 and prior.