CVE-2026-49271

Name of the Vulnerable Software and Affected Versions libheif versions prior to 1.22.1

Description The uncompressed HEIF decoder validates explicit icef compressed-unit offsets using unit offset + unit size. An integer wrap during this addition allows a crafted HEIF file to bypass range checks and construct a vector from iterators outside the compressed item buffer, resulting in an out-of-bounds heap read and a system crash.

Recommendations Update to version 1.22.1.