CVE-2026-49271

What it actually does

CVE-2026-49271 is an out-of-bounds heap read in libheif's uncompressed HEIF decoder prior to version 1.22.1. The vulnerable range validation calculates explicit icef compressed-unit boundaries using unit_offset + unit_size without safely handling integer wraparound. A malicious HEIF/AVIF file can cause this arithmetic to overflow, pass validation incorrectly, and then make the decoder construct a vector from iterators outside the valid compressed item buffer. The expected result is a process crash and denial of service in applications, services, thumbnailers, media pipelines, or content processing workflows that decode attacker-supplied HEIF/AVIF files using the vulnerable library.

Why it matters to the business

Organizations that accept, preview, scan, transform, or index HEIF/AVIF images may experience crashes or service interruptions when a crafted image is processed. Impact is primarily availability-related rather than data theft or code execution based on current information. Because libheif is a common library used by many image viewers, web services, document systems, media pipelines, and desktop thumbnailers, exposure may exist indirectly through downstream software even if libheif is not deployed as a standalone application. The issue is not currently listed in CISA KEV, has no known exploit maturity, and has low EPSS, so broad active exploitation is not indicated, but patching is still recommended where untrusted image content is processed.

How an attack unfolds

An attacker creates a specially crafted HEIF file containing malformed uncompressed image data with explicit icef compressed-unit offset and size values chosen so that unit_offset + unit_size wraps around. When a vulnerable libheif version decodes the file, the wrapped value can satisfy the bounds check even though the requested range is outside the compressed item buffer. The decoder then attempts to construct a vector from invalid iterators beyond the heap buffer, causing an out-of-bounds read and typically crashing the host process. Exploitation requires that a user or automated system process the crafted image, such as by opening it, uploading it to a service, generating a thumbnail, scanning it, or converting it to another format.

How to fix it

Upgrade libheif to version 1.22.1 or later wherever it is used directly or embedded through downstream packages. If operating system or application vendors package libheif, apply the vendor-provided security update rather than building manually unless required. Rebuild or redeploy applications, containers, serverless images, desktop bundles, and media-processing workers that statically link or vendor libheif. If immediate patching is not possible, reduce exposure by blocking or quarantining untrusted HEIF/AVIF uploads, disabling automatic thumbnailing or conversion for HEIF/AVIF content, imposing strict file validation and size limits, isolating image decoding in a sandboxed worker with restart controls, and ensuring crashes in media-processing components do not affect core service availability.

How to confirm the fix worked

Confirm installed or bundled libheif versions are 1.22.1 or later using package manager inventory, software composition analysis, container image scans, binary dependency inspection, or application SBOMs. Validate both dynamically linked system libraries and statically bundled copies in applications and containers. Where safe and authorized, regression-test image-processing paths with vendor or maintainer test cases for the patched condition and confirm the process rejects malformed input without crashing. Review CI/CD and artifact repositories to ensure rebuilt applications are using the patched dependency. For exposed services, verify that HEIF/AVIF upload, preview, conversion, and thumbnail-generation paths are either patched, disabled, or isolated.

Typical attack path

1. Identify an application, service, desktop component, or media-processing workflow that uses libheif prior to 1.22.1 to decode HEIF/AVIF files.
2. Craft a HEIF file with explicit icef compressed-unit offset and size fields that trigger integer wraparound during range validation.
3. Deliver the file through an accepted input path, such as file upload, email attachment, shared storage, image processing API, content management system, or local file open action.
4. Wait for the vulnerable decoder to parse the file during preview, thumbnail generation, validation, indexing, conversion, or user viewing.
5. Cause the decoding process to perform an out-of-bounds heap read and crash, resulting in denial of service for the affected process or dependent workflow.

How to detect it

Look for evidence of process crashes or repeated restarts in components that parse HEIF/AVIF images, especially after handling recently uploaded, emailed, synchronized, or indexed image files. Relevant log sources include application logs for image upload and conversion services, web server upload logs, media pipeline worker logs, desktop crash reporters, systemd or service supervisor journals, container orchestration restart events, endpoint detection telemetry, and core dump records. Search for crashes in binaries or processes linked to libheif, image thumbnailers, converters, preview generators, and applications that process .heif, .heic, or .avif files. Indicators are likely to be behavioral rather than fixed strings: segmentation faults, aborts, out-of-bounds read sanitizer reports, heap-buffer-overflow/read messages, or repeated crashes immediately after processing the same HEIF/AVIF file. Preserve suspicious input files and correlate timestamps between upload/access events and crash/core dump creation. No public threat actor exploitation is currently reported, and the CVE is not in CISA KEV, so detection should focus on anomaly hunting and crash forensics rather than known campaign indicators.

• libheif
• heif_context_read_from_file
• heif_context_read_from_memory
• heif_decode_image
• icef
• Segmentation fault
• SIGSEGV
• heap-buffer-overflow
• out-of-bounds read
• .heif
• .heic
• .avif
• AddressSanitizer
• runtime error: unsigned integer overflow
• core dumped

What your security team should do

• Inventory applications, containers, desktop software, and media-processing services that decode HEIF or AVIF files and identify those using libheif prior to 1.22.1.
• Prioritize patching internet-facing or user-facing workflows that process untrusted image uploads, attachments, or shared files.
• Upgrade to libheif 1.22.1 or a vendor security release that includes the fix, then rebuild and redeploy any statically linked or vendored applications.
• Temporarily restrict HEIF/AVIF processing from untrusted sources if patching cannot be completed promptly.
• Run image decoding components with least privilege, sandboxing, memory safety hardening, process isolation, and automatic restart limits to reduce operational impact from malformed files.
• Monitor image-processing services for abnormal crashes, repeated worker restarts, and malformed HEIF/AVIF submissions.
• Add this dependency to software composition analysis and SBOM monitoring so future libheif security fixes are tracked across downstream products.