CyberRota Analysis
AI-Generatedlibheif versions prior to 1.23.2 are vulnerable to a buffer overflow due to improper handling of tile dimensions in the heif_context_add_image_tile() function when the WITH_UNCOMPRESSED_CODEC option is enabled. This flaw allows attackers to manipulate component-plane dimensions, potentially leading to arbitrary code execution or data corruption. Organizations using libheif for HEIF or AVIF file processing should prioritize upgrading to version 1.23.2 to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, when WITH_UNCOMPRESSED_CODEC is enabled, heif_context_add_image_tile() accepts an independently constructed tile whose component-plane dimensions do not match the tile geometry established by the prototype image. ImageItem_uncompressed::add_image_tile() passes that tile directly to unc_encoder::encode_tile(), which lacked the check_component_sizes() gate and sizes its output from the configured tile geometry while copying the tile's actual component-plane dimensions. An oversized component plane can therefore make unc_encoder_component_interleave::encode_tile() copy attacker-controlled data beyond the heap output buffer. This issue is fixed in version 1.23.2.