CVE-2026-41071: Struktur Libheif Buffer Overflow Flaw

CVE-2026-41071 Overview

CVE-2026-41071 is a heap-buffer-overflow vulnerability in libheif, an open-source HEIF and AVIF file format decoder and encoder maintained by struktur. The flaw affects versions 1.21.2 and prior. A crafted HEIF sequence file whose saiz box declares more samples than exist in the track's chunk table triggers an out-of-bounds read in the SampleAuxInfoReader constructor. The vulnerability is reachable through heif_context_read_from_file during normal file parsing, requiring no user interaction beyond opening the file. Any application using libheif to process untrusted HEIF files is affected. The issue is fixed in version 1.22.0.

Critical Impact
An attacker delivering a malicious HEIF file can trigger an out-of-bounds heap read, leading to information disclosure or process crash in any application linking against vulnerable libheif versions.

Affected Products

struktur libheif versions 1.21.2 and prior
Applications and image viewers linking against vulnerable libheif builds
Linux distributions packaging libheif ≤ 1.21.2

Discovery Timeline

2026-05-22 - CVE-2026-41071 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-41071

Vulnerability Analysis

The vulnerability resides in the SampleAuxInfoReader constructor within libheif. The constructor iterates over the sample count returned by saiz->get_num_samples() to populate auxiliary sample information used during HEIF sequence decoding. The implementation fails to validate that the declared sample count remains consistent with the number of entries present in the track's chunks vector. This inconsistency between attacker-controlled metadata and actual container structure is the root of the bug, classified under [CWE-125] Out-of-Bounds Read.

Root Cause

During the sample iteration loop, the code increments current_chunk to walk through the chunks vector as samples are processed. Because the loop bound derives solely from saiz->get_num_samples(), a crafted file can declare more samples than the chunk table covers. Once current_chunk exceeds chunks.size(), subsequent accesses dereference memory beyond the vector's heap allocation, producing the out-of-bounds read.

Attack Vector

Exploitation requires the victim to open a crafted HEIF sequence file with an application that uses libheif. The parsing path heif_context_read_from_file reaches the vulnerable constructor without additional checks, so no user action beyond file loading is needed. Typical delivery vectors include email attachments, web downloads, messaging applications, and automated thumbnailers that decode HEIF content from untrusted sources. The resulting read can leak adjacent heap data or crash the host process, denying service to image-handling workflows.

No verified public proof-of-concept code is available. Refer to the GitHub Security Advisory GHSA-xj92-xjff-h8w3 for technical details.

Detection Methods for CVE-2026-41071

Indicators of Compromise

Crashes or abnormal terminations in processes invoking libheif parsing routines, particularly heif_context_read_from_file.
HEIF files whose saiz box reports a sample_count larger than the number of samples covered by the track's chunk table.
AddressSanitizer (ASan) reports flagging heap-buffer-overflow reads inside SampleAuxInfoReader.

Detection Strategies

Inventory all software that bundles or dynamically links libheif and compare installed versions against 1.22.0.
Apply static composition analysis on container images and application bundles to identify vulnerable libheif builds.
Validate HEIF inputs in pre-processing pipelines by parsing the saiz and stco/co64 boxes and rejecting files with inconsistent sample-to-chunk counts.

Monitoring Recommendations

Monitor endpoint telemetry for unexpected crashes of image viewers, thumbnailers, and document processors that handle HEIF content.
Alert on file-handler processes spawning crash-reporter children after opening .heif, .heic, or .heifs files from untrusted sources.
Track package management events that downgrade libheif or install builds older than 1.22.0.

How to Mitigate CVE-2026-41071

Immediate Actions Required

Upgrade libheif to version 1.22.0 or later across all systems and container images.
Rebuild and redistribute applications that statically link libheif once the patched library is integrated.
Restrict opening of HEIF files received from untrusted sources until patched binaries are deployed.

Patch Information

The maintainers fixed the issue in libheif1.22.0. The patched constructor validates the sample count from the saiz box against the chunk table size and bounds iteration accordingly. Release artifacts and changelog are published at the GitHub Release v1.22.0. Coordinated disclosure details are documented in the GitHub Security Advisory GHSA-xj92-xjff-h8w3.

Workarounds

Disable automatic HEIF thumbnail generation and preview in file managers until patches are applied.
Sandbox or isolate processes that decode HEIF content to limit the impact of out-of-bounds reads.
Apply content filtering at email and web gateways to block HEIF attachments from untrusted senders during the remediation window.

bash

# Verify the installed libheif version on Linux systems
dpkg -l | grep libheif      # Debian/Ubuntu
rpm -qa | grep libheif      # RHEL/Fedora

# Upgrade to the patched release
sudo apt-get update && sudo apt-get install --only-upgrade libheif1