PatchSiren cyber security CVE debrief
CVE-2026-41069 strukturag CVE debrief
## Summary libheif ≤1.21.2 contains an out-of-bounds read in its HEIF/AVIF sequence-parsing logic. A malformed file with `stco.entry_count == 0` (no chunks) but `saiz.sample_count > 0` causes the `SampleAuxInfoReader` constructor to dereference `chunks[0]` on an empty vector, resulting in denial of service. ## Affected Products - **Product:** libheif - **Versions:** 1.21.2 and prior - **Fixed in:** 1.22.0 ## Root Cause The sequence parsing code validates that `stco.entry_count` matches `saio.entry_count`, but does not prevent entry counts of zero. When both are zero, validation passes. However, if `saiz.sample_count > 0`, the `SampleAuxInfoReader` constructor still enters its processing loop and attempts to access `chunks[0]` in chunked mode, causing an out-of-bounds read on the empty chunks vector. ## Impact - **CVSS 3.1:** 6.5 (MEDIUM) - **Vector:** AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - **Impact:** Denial of service via application crash - **Confidentiality/Integrity:** None ## Exploitation - **Attack Vector:** Network - **Attack Complexity:** Low - **Privileges Required:** None - **User Interaction:** Required (victim must open/process malicious file) - **Scope:** Unchanged An attacker can craft a malicious HEIF sequence file that triggers the vulnerability when processed by an application using libheif. ## Mitigation Upgrade to libheif 1.22.0 or later. ## References - CVE Record: CVE-2026-41069 - NVD Entry: CVE-2026-41069 - GitHub Security Advisory: GHSA-p82x-fpmv-576r - libheif 1.22.0 Release: v1.22.0 ## Timeline - **2026-05-22:** CVE published - **2026-05-26:** CVE modified
- Vendor
- strukturag
- Product
- libheif
- CVSS
- MEDIUM 6.5
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-22
- Original CVE updated
- 2026-05-27
- Advisory published
- 2026-05-22
- Advisory updated
- 2026-05-27
Who should care
Organizations using applications that process HEIF or AVIF images with libheif, particularly those handling user-submitted content. Developers integrating libheif into image processing pipelines. Security teams monitoring for denial-of-service vectors in multimedia processing libraries.
Technical summary
The vulnerability exists in libheif's sequence parsing logic where insufficient validation of chunk entry counts allows an out-of-bounds memory access. When a malformed HEIF file presents `stco.entry_count == 0` and `saio.entry_count == 0` (passing validation) but `saiz.sample_count > 0`, the SampleAuxInfoReader constructor enters its loop and attempts to access `chunks[0]` despite the chunks vector being empty. This causes an out-of-bounds read and application crash. The fix in version 1.22.0 adds proper validation to prevent this code path from executing with empty chunk vectors.
Defensive priority
medium
Recommended defensive actions
- Upgrade libheif to version 1.22.0 or later
- Validate HEIF/AVIF files from untrusted sources before processing
- Monitor application logs for crashes when processing image files
- Consider sandboxing image processing operations
- Review applications using libheif for exposure to untrusted HEIF/AVIF content
Evidence notes
Root cause analysis derived from CVE description and GitHub security advisory. CVSS vector and score from NVD source data. Fix version confirmed via GitHub release reference.
Official resources
2026-05-22