CVE-2025-68431

libheif is an HEIF and AVIF file format decoder and encoder. Prior to version 1.21.0, a crafted HEIF that exercises the overlay image item path triggers a heap buffer over-read in HeifPixelImage::overlay. The function computes a negative row length likely from an unclipped overlay rectangle or...

CVE-2025-68431

CVE-2025-68431 affects libheif prior to 1.21.0. A crafted HEIF can trigger a heap buffer over-read in HeifPixelImage::overlay() when an overlay path yields a negative row length, which underflows to size_t and causes a large read past the source plane, potentially crashing. A patch exists in 1.21...