CVE-2026-48029 PUBLISHED

libheif: heap OOB read in ImageItem_Grid::decode_grid_tile via irot-induced tile-coordinate underflow

Assigner: GitHub_M
Reserved: 20.05.2026 Published: 22.07.2026 Updated: 22.07.2026

libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.19.0 through 1.21.2 have a heap OOB read in ImageItem_Grid::decode_grid_tile via irot-induced tile-coordinate underflow. Version 1.22.0 fixes the issue.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
CVSS Score: 7.1

Product Status

Vendor strukturag
Product libheif
Versions
  • Version >= 1.19.0, < 1.22.0 is affected

References

Problem Types

  • CWE-125: Out-of-bounds Read CWE
  • CWE-191: Integer Underflow (Wrap or Wraparound) CWE