CyberRota Analysis
AI-GeneratedLibheif versions prior to 1.22.0 are vulnerable to crashes when processing malformed uncompressed HEIF images with specific property configurations, leading to potential denial of service through null pointer dereferences. This vulnerability primarily affects applications utilizing the libheif library for HEIF and AVIF file decoding and encoding. Developers and organizations relying on libheif for image processing should prioritize upgrading to version 1.22.0 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
libheif is a HEIF and AVIF file format decoder and encoder. Versions prior to 1.22.0 crashes in the public C API `heif_image_handle_get_image_tiling()` when a malformed uncompressed HEIF image item has an associated `uncC` property but no associated `ispe` property. In debug builds this trips the `ispe && uncC` assertion in `ImageItem_uncompressed::get_heif_image_tiling()`. In a release/NDEBUG ASan build, the same file causes a null pointer read at address `0xa8`. Version 1.22.0 fixes the issue.
Related CVEs
Other vulnerabilities affecting the same vendor(s)