CVE-2024-41311

What it actually does

Insufficient bounds checks in ImageOverlay::parse() when processing HEIF overlay images with attacker-controlled offsets permit out-of-bounds read and write operations during file decoding.

Why it matters to the business

Applications that decode HEIF images may crash or experience memory corruption, disrupting image-processing pipelines and potentially allowing arbitrary code execution in affected environments.

How an attack unfolds

An attacker crafts a malicious HEIF file containing an overlay image whose offsets are deliberately forged beyond allocated buffers. When a vulnerable application parses the file using the affected libheif code path, the missing validation triggers an out-of-bounds read followed by a write, leading to memory corruption that can be leveraged for code execution.

How to fix it

Upgrade strukturag/libheif to commit a3ed1b1eb178c5d651d6ac619c8da3d71ac2be36 or later. Rebuild and redeploy all dependent applications. Where immediate upgrade is impossible, isolate HEIF processing or disable overlay image support if configurable.

How to confirm the fix worked

Confirm the installed libheif version or git commit hash includes a3ed1b1eb178c5d651d6ac619c8da3d71ac2be36. Re-run unit tests covering ImageOverlay parsing and attempt processing of malformed HEIF test files to verify absence of crashes or sanitizer violations.

Typical attack path

1. Create a HEIF file with a forged overlay image structure containing invalid offsets
2. Deliver the file to a target via email, download, or shared storage
3. Victim application opens or processes the file using libheif 1.17.6 or earlier
4. ImageOverlay::parse() performs unchecked offset arithmetic resulting in OOB memory access
5. Attacker-controlled data is read or written, enabling further exploitation such as ROP or information disclosure

How to detect it

Review application crash logs and memory sanitizer reports for segmentation faults or out-of-bounds access during HEIF decoding. Correlate file-processing events with subsequent suspicious memory or process behavior in environments that handle untrusted HEIF content.

What your security team should do

• Immediately inventory all products and containers using strukturag/libheif and schedule upgrade to the fixed commit
• Prioritize patching in any internet-facing or user-content ingestion services
• Add HEIF file handling to the list of monitored risky formats for sandboxing or content-disarmament controls
• Monitor EPSS and exploit maturity signals; reassess if scores rise