CyberRota Analysis
AI-GeneratedThe vulnerability affects libheif, specifically in the `Track::init_sample_timing_table()` function, where an out-of-bounds chunk index can lead to a heap-buffer overflow due to improper handling of chunk and sample counts. This flaw could potentially allow an attacker to execute arbitrary code or crash the application when processing malicious HEIF or AVIF files. Users and developers utilizing versions prior to 1.22.0 should prioritize updating to the latest version to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, `Track::init_sample_timing_table()` in `libheif/sequences/track.cc` stores an out-of-bounds chunk index (`m_chunks.size()`) into `m_presentation_timeline` when the number of chunks defined in the `stco` box is less than the number of samples in `stsz`. A subsequent call to `heif_track_get_next_raw_sequence_sample()` reads `m_chunks[chunk_idx]` with that OOB index, causing a heap-buffer-overflow. Version 1.22.0 fixes the issue.
Related CVEs
Other vulnerabilities affecting the same vendor(s)