important · Zero-click
A crafted HEIF auxiliary-image graph can crash libheif during decoding.
Affects
libheif, the cross-platform HEIF and AVIF decoding library used by image applications and server-side processors.
An unsupported auxiliary item receives a null context that verify_decodable dereferences when a consumer traverses or decodes it.
Detail and 4 sources
Upstream published a complete regression-file generator, but released-version scope and receipt-only reachability remain unverified.
Chain to watch
Deliver a crafted HEIF file to a default consumer→↓Cause automatic auxiliary-image traversal→↓Terminate the receiving or indexing process→↓Receipt-only behavior in mail clients, thumbnailers, chat clients, indexers, and upload processors is not established.
Unverified chainRun the regression-file generator through default desktop thumbnailers and common inline-attachment paths.
Sources
Patchhttps://github.com/strukturag/libheif/commit/4ee499d2715a62c62aa2a5c1fb5915758bd7fce4.patchPatchhttps://github.com/strukturag/libheif/commit/3e01ff32b5eb8fd1570cb33e4ed89e0a426fc732.patchSecondaryGive ImageItem_Error a real context to fix a null-deref in verify_dec… · strukturag/libheif@4ee499dSecondaryReject items with an item-error in the depth/aux/thumbnail handle get… · strukturag/libheif@3e01ff3