libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.21.2 and prior contain a heap-buffer-overflow (write) vulnerability in the grid tile compositing, allowing an attacker to write 64 bytes of fully attacker-controlled data past the end of a chroma plane heap allocation by crafting a HEIF/AVIF file with a 1×4 grid of odd-height tiles. The overflow is triggered during normal image decoding with default build configuration. The written bytes are chroma (Cb/Cr) pixel values from the attacking tile, giving the attacker full control over the overflow content. This issue has been fixed in version 1.22.0.

In libavif before 1.3.0, avifImageRGBToYUV in reformat.c has integer overflows in multiplications involving rgbRowBytes, yRowBytes, uRowBytes, and vRowBytes.

In libavif before 1.3.0, makeRoom in stream.c has an integer overflow and resultant buffer overflow in stream->offset+size.

Integer overflow in libaom internal function imgallochelper can lead to heap buffer overflow. This function can be reached via 3 callers:

Calling aomimgalloc() with a large value of the dw, dh, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned aomimaget struct may be invalid. Calling aomimgwrap() with a large value of the dw, dh, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned aomimaget struct may be invalid. Calling aomimgallocwithborder() with a large value of the dw, dh, align, sizealign, or border parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned aomimaget struct may be invalid.

Increasing the resolution of video frames, while performing a multi-threaded encode, can result in a heap overflow in av1looprestorationdealloc().

AOMedia v3.0.0 to v3.5.0 was discovered to contain an invalid read memory access via the component assignframebufferp in av1/common/av1commonint.h.

AOM v2.0.1 was discovered to contain a NULL pointer dereference via the component ratehist.c.

AOM v2.0.1 was discovered to contain a stack buffer overflow via the component stats/ratehist.c.

AOM v2.0.1 was discovered to contain a NULL pointer dereference via the component av1/av1dxiface.c.

AOM v2.0.1 was discovered to contain a global buffer overflow via the component av1/encoder/partitionsearch.h.

AOM v2.0.1 was discovered to contain a segmentation violation via the component aomdsp/x86/obmcsadavx2.c.

AOM v2.0.1 was discovered to contain a stack buffer overflow via the component src/aomimage.c.

libavif 0.8.0 and 0.8.1 has an out-of-bounds write in avifDecoderDataFillImageGrid.

aomdsp/noisemodel.c in libaom in AOMedia before 2021-03-24 has a buffer overflow.

aomdsp/graintable.c in libaom in AOMedia before 2021-03-30 has a use-after-free.

aomimage.c in libaom in AOMedia before 2021-04-07 frees memory that is not located on the heap.