CVE-2025-62821

Name of the Vulnerable Software and Affected Versions Microsoft HEIF Image Extensions version 1.2.22.0

Description An out-of-bounds read occurs because the CHEIFItemInfoEntry GetDataSize() function can return a success status while leaving the reported data size at 0. This leads a caller to perform a 1-byte allocation. Subsequently, the CopyPixels() function calculates copy size using the formula stride * abs(roi height) but fails to verify the source buffer length before executing a memmove call.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.