CVE-2026-48029: libheif Buffer Overflow Vulnerability

CVE-2026-48029 Overview

CVE-2026-48029 is a heap out-of-bounds read vulnerability in libheif, a widely used HEIF and AVIF file format decoder and encoder maintained by Struktur AG. The flaw resides in ImageItem_Grid::decode_grid_tile and is triggered by an irot-induced tile-coordinate underflow when processing rotated grid images. Attackers can craft malicious HEIF or AVIF files that cause the decoder to read outside allocated heap memory. Versions 1.19.0 through 1.21.2 are affected, and version 1.22.0 remediates the issue [CWE-125].

Critical Impact
A crafted HEIF or AVIF image can trigger a heap out-of-bounds read, causing process crashes or leaking adjacent memory contents in any application that decodes untrusted images with libheif.

Affected Products

libheif version 1.19.0 through 1.21.2
Applications and libraries embedding vulnerable libheif builds for HEIF/AVIF decoding
Downstream image processing pipelines that accept untrusted user-supplied images

Discovery Timeline

2026-07-22 - CVE-2026-48029 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-48029

Vulnerability Analysis

The vulnerability is a heap out-of-bounds read in libheif's grid-tile decoding path. When a HEIF grid image carries an irot (image rotation) transformation of 90° or 270°, the displayed tile grid has its columns and rows swapped relative to the on-disk layout. The original code validated the caller-supplied (tile_x, tile_y) against the file's grid dimensions before applying the inverse rotation. Because the displayed dimensions differ from the file dimensions for 90°/270° rotations, out-of-range coordinates were accepted. The subsequent inverse-rotation arithmetic, such as num_rows - 1 - tile_x, produced an unsigned integer underflow when tile_x >= num_rows. The resulting wrapped index was then used to compute a tile offset into the heap-allocated tile array.

Root Cause

The root cause is a validation ordering defect combined with unsigned integer underflow. In libheif/api/libheif/heif_tiling.cc and libheif/image-items/image_item.cc, coordinates were compared against the file's columns/rows rather than the displayed grid dimensions. When process_image_transformations was set and an irot box swapped the axes, the check permitted coordinates that were valid in the displayed grid but exceeded the pre-transform bounds used inside the inverse formulas. The bounded-below uint32_t arithmetic then wrapped, producing very large indices for the final tile lookup.

Attack Vector

Exploitation requires an attacker to deliver a crafted HEIF or AVIF file to a target that decodes it using vulnerable libheif. User interaction is required, typically opening an image in a viewer, uploading it to a service that generates thumbnails, or rendering it in a chat or mail client. No authentication or elevated privileges are required on the target. Successful exploitation results in a heap out-of-bounds read that can crash the host process or, in some configurations, leak adjacent heap memory to the attacker.

text

// Security patch (libheif/api/libheif/heif_tiling.cc)
// Source: https://github.com/strukturag/libheif/commit/e523ec0bf379110b7c33d4c159f8b1202d332157
   }
 
   const ImageGrid& gridspec = gridItem->get_grid_spec();
-  if (tile_x >= gridspec.get_columns() || tile_y >= gridspec.get_rows()) {
+
+  if (process_image_transformations) {
+    // transform_requested_tile_position_to_original_tile_position() validates
+    // (tile_x, tile_y) against the *displayed* tile-grid dimensions (which may
+    // differ from the file's dimensions when a 90°/270° rotation is present)
+    // before mapping the coordinates back to the in-file grid.
+    Error err = gridItem->transform_requested_tile_position_to_original_tile_position(tile_x, tile_y);
+    if (err) {
+      return err.error_struct(handle->context.get());
+    }
+  }
+  else if (tile_x >= gridspec.get_columns() || tile_y >= gridspec.get_rows()) {
     return {
       heif_error_Usage_error,
       heif_suberror_Unspecified,
       "Grid tile index out of range"
     };
   }
 
-  if (process_image_transformations) {
-    gridItem->transform_requested_tile_position_to_original_tile_position(tile_x, tile_y);
-  }
-
   *tile_item_id = gridItem->get_grid_tiles()[tile_y * gridspec.get_columns() + tile_x];
 
   return heif_error_ok;

The patch reorders validation to occur against the displayed tile-grid dimensions and returns an error before any inverse-rotation arithmetic executes. A companion fix in libheif/image-items/image_item.cc tracks intermediate grid dimensions across each property in reverse order so that 90°/270° rotations correctly swap the extents used by subsequent inverse steps. See the GitHub commit e523ec0 for the full change.

Detection Methods for CVE-2026-48029

Indicators of Compromise

Unexpected crashes or SIGSEGV signals in processes linking libheif.so when handling HEIF/AVIF input
HEIF/AVIF files containing an irot box with rotation values of 1 or 3 (90° or 270°) combined with grid (grid) derivation items
Grid-derived HEIF images where tile coordinate ranges do not match the rotated display geometry

Detection Strategies

Inventory installed libheif versions on servers, workstations, and container images, flagging any build between 1.19.0 and 1.21.2
Enable AddressSanitizer or hardened memory allocators on image-processing services to surface out-of-bounds reads during fuzzing and testing
Scan file upload pipelines and mail gateways for HEIF/AVIF payloads and inspect them for irot transformations paired with grid items

Monitoring Recommendations

Alert on repeated crashes of image thumbnailers, browsers, or mail clients correlated with recently received HEIF/AVIF attachments
Log and retain samples of HEIF/AVIF files that cause parser errors from libheif for offline analysis
Monitor package management events for updates to libheif and downstream consumers such as gdk-pixbuf, ImageMagick, and libvips

How to Mitigate CVE-2026-48029

Immediate Actions Required

Upgrade libheif to version 1.22.0 or later on all systems and container images that decode HEIF or AVIF content
Rebuild and redeploy any application statically linking libheif against the fixed release
Restrict acceptance of HEIF and AVIF uploads on internet-facing services until patched libraries are deployed

Patch Information

The fix is committed as e523ec0bf379110b7c33d4c159f8b1202d332157 and shipped in libheif 1.22.0. See the GitHub Security Advisory GHSA-6x5f-qchq-cxqv for the vendor's advisory and the upstream commit for the patch content. Linux distribution maintainers are backporting the change; apply distribution updates once available.

Workarounds

Disable HEIF and AVIF decoding in applications that expose the format to untrusted input if patching cannot be performed immediately
Sandbox image decoding processes using seccomp, AppArmor, or containers to contain out-of-bounds reads and limit information disclosure
Strip or reject HEIF/AVIF files containing irot transformations at ingress using a pre-validation step before invoking libheif

bash

# Verify installed libheif version and upgrade on Debian/Ubuntu
dpkg -l | grep -i libheif
sudo apt-get update && sudo apt-get install --only-upgrade libheif1

# Verify installed libheif version and upgrade on RHEL/Fedora
rpm -q libheif
sudo dnf upgrade libheif

# Confirm the runtime version is >= 1.22.0
heif-info --version