CVE-2025-62821

Microsoft HEIF Image Extensions 1.2.22.0 has an out-of-bounds read because CHEIFItemInfoEntry_GetDataSize can return success while leaving the reported data size as 0. This causes a caller to make a 1-byte allocation. Later, CopyPixels computes copy_size = stride * abs(roi_height) but does not check the source buffer length before a memmove call.

• CWE-125

• https://github.com/hyunjungg/CVE-2025-62821Exploit, Third Party Advisory
• https://github.com/hyunjungg/CVE-2025-62821Exploit, Third Party Advisory

Published

Jun 19, 2026

Last Modified

Jun 30, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-62815An issue was discovered in Samsung Mobile Processor Exynos 1…5.5
• CVE-2025-62816An issue was discovered in Samsung Mobile Processor Exynos 1…5.5
• CVE-2025-62817An issue was discovered in Samsung Mobile Processor Exynos 1…7.5
• CVE-2025-62818An issue was discovered in Samsung Mobile Processor, Wearabl…9.8
• CVE-2025-6282A vulnerability was found in xlang-ai OpenAgents up to ff2e4…9.8
• CVE-2025-62820Slack Nebula before 1.9.7 mishandles CIDR in some configurat…4.9
• CVE-2025-62826An Improper Neutralization of CRLF Sequences in HTTP Headers…4.3
• CVE-2025-62827Rejected reason: Not used
• CVE-2025-62828Rejected reason: Not used
• CVE-2025-62829Rejected reason: Not used
• CVE-2025-6283A vulnerability was found in xataio Xata Agent up to 0.3.0. …7.5
• CVE-2025-62830Rejected reason: Not used