CVE-2025-68431
Medium · 6.5CVSS
6.5
EPSS
0.4%
Published
Dec 29, 2025
CISA due date
—
The record
libheif is an HEIF and AVIF file format decoder and encoder. Prior to version 1.21.0, a crafted HEIF that exercises the overlay image item path triggers a heap buffer over-read in `HeifPixelImage::overlay()`. The function computes a negative row length (likely from an unclipped overlay rectangle or invalid offsets), which then underflows when converted to `size_t` and is passed to `memcpy`, causing a very large read past the end of the source plane and a crash. Version 1.21.0 contains a patch. As a workaround, avoid decoding images using `iovl` overlay boxes.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| SUSE:Linux Enterprise Module for Desktop Applications 15 SP7 | libheif | 0 | 1.19.5-150700.3.3.1 |
| SUSE:Linux Enterprise Module for Package Hub 15 SP7 | libheif | 0 | 1.19.5-150700.3.3.1 |
| openSUSE:Leap 15.6 | libheif | 0 | 1.12.0-150400.3.17.1 |
| openSUSE:Leap 16.0 | libheif | 0 | 1.23.0-160000.1.1 |
| openSUSE:Leap 16.0 | libheif | 0 | 1.19.7-160000.3.1 |
| openSUSE:Tumbleweed | libheif | 0 | 1.21.1-1.1 |
Related vulnerabilities
- CVE-2024-41311 In Libheif 1.17.6, insufficient checks in ImageOverlay::parse() decoding a heif file… Also affects libheif
- CVE-2026-50142 libheif is a HEIF and AVIF file format decoder and encoder. Also affects libheif
- CVE-2026-49271 libheif is a HEIF and AVIF file format decoder and encoder. Also affects libheif
- CVE-2026-41071 libheif is a HEIF and AVIF file format decoder and encoder. Also affects libheif
- CVE-2026-41069 libheif is a HEIF and AVIF file format decoder and encoder. Also affects libheif
- CVE-2026-32741 libheif is a HEIF and AVIF file format decoder and encoder. Also affects libheif
- CVE-2026-32814 libheif is a HEIF and AVIF file format decoder and encoder. Also affects libheif
- CVE-2026-32882 libheif is a HEIF and AVIF file format decoder and encoder. Also affects libheif