References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [email protected].

Known Affected Software Configurations Switch to CPE 2.2

Change History

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

OR
          *cpe:2.3:a:struktur:libheif:*:*:*:*:*:*:*:* versions up to (excluding) 1.22.0

CISA-ADP: https://github.com/strukturag/libheif/security/advisories/GHSA-7f2h-cmpf-v9ww Types: Exploit, Vendor Advisory

GitHub, Inc.: https://github.com/strukturag/libheif/security/advisories/GHSA-7f2h-cmpf-v9ww Types: Exploit, Vendor Advisory

https://github.com/strukturag/libheif/security/advisories/GHSA-7f2h-cmpf-v9ww

libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and below, a crafted 792-byte HEIF sequence file with samples_per_chunk=0 in the stsc box causes an unsigned integer underflow in the Chunk constructor (m_last_sample = 0 + 0 - 1 = UINT32_MAX), mapping all samples to an empty chunk and resulting in a denial of service. When any sample is accessed, the library reads from index 0 of an empty std::vector, causing a guaranteed SEGV (null-page read). The file parses successfully without producing an error; the crash occurs on the first frame access. This issue has been fixed in version 1.22.0.

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CWE-125

CWE-476

https://github.com/strukturag/libheif/security/advisories/GHSA-7f2h-cmpf-v9ww