PT-2026-76137
Published
2026-08-03
·
Updated
2026-08-03
Description by
CVSS 3.1
5.5
MediumMetricsAV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
libheif is a HEIF and AVIF file format decoder and encoder. Versions prior to 1.22.0 crashes in the public C API
heif image handle get image tiling() when a malformed uncompressed HEIF image item has an associated uncC property but no associated ispe property. In debug builds this trips the ispe && uncC assertion in ImageItem uncompressed::get heif image tiling(). In a release/NDEBUG ASan build, the same file causes a null pointer read at address 0xa8. Version 1.22.0 fixes the issue.Exploitability
Fix
Vendors
Affected products
Related identifiers
Found an issue in the description? Have something to add? Feel free to write us 👾