libheif’s overlay compositing routine performs a heap buffer over‑read when an overlay image’s alpha channel has a different bit depth than its color channels. The routine incorrectly uses the color stride to index the alpha buffer, allowing reads beyond its end—up to 3,123 bytes in a 100×50 10‑bit image. A crafted HEIF file can trigger this read, leading to a crash (denial of service) or leakage of adjacent heap memory, potentially exposing sensitive data in the decoded output pixels.

strukturag libheif, versions 1.21.2 and earlier, are affected. The vulnerability was fixed in release 1.22.0 and later versions. Any system that decodes HEIF/AVIF files using these library versions is at risk.

The vulnerability is rated CVSS 7.1 (high). EPSS is not available and the issue is not listed in the CISA KEV catalog. Attack requires a crafted HEIF file containing an overlay with mismatched alpha bit depth supplied to the libheif decoder. The exploit can be local—any application that uses the library to open a file can trigger the over‑read, or remote if the attacker can cause the target to process malicious content from an untrusted source.