CVE-2026-48029

Name of the Vulnerable Software and Affected Versions libheif versions 1.19.0 through 1.21.2

Description libheif, a HEIF and AVIF file format decoder and encoder, contains a heap out-of-bounds (OOB) read. This occurs in the ImageItem Grid::decode grid tile() function due to a tile-coordinate underflow induced by the irot box. This issue can lead to application crashes, such as segmentation faults, when processing specific HEIC grid images, particularly portrait photos from certain mobile devices.

Recommendations Update libheif to version 1.22.0.