CVE-2025-68431

libheif is an HEIF and AVIF file format decoder and encoder. Prior to version 1.21.0, a crafted HEIF that exercises the overlay image item path triggers a heap buffer over-read in `HeifPixelImage::overlay()`. The function computes a negative row length (likely from an unclipped overlay rectangle or invalid offsets), which then underflows when converted to `size_t` and is passed to `memcpy`, causing a very large read past the end of the source plane and a crash. Version 1.21.0 contains a patch. As a workaround, avoid decoding images using `iovl` overlay boxes.

• CWE-125
• CWE-190

• https://github.com/strukturag/libheif/commit/b8c12a7b70f46c9516711a988483bed377b78d46Patch
• https://github.com/strukturag/libheif/releases/tag/v1.21.0Product, Release Notes
• https://github.com/strukturag/libheif/security/advisories/GHSA-j87x-4gmq-cqfqExploit, Patch, Vendor Advisory

Published

Dec 29, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-68421Comarch ERP Optima client makes use of a hard-coded password…8.7
• CVE-2025-68422Improper Authorization (CWE-285) in Kibana can lead to privi…4.3
• CVE-2025-68428jsPDF is a library to generate PDFs in JavaScript. Prior to …7.5
• CVE-2025-68429Storybook is a frontend workshop for building user interface…5.3
• CVE-2025-6843A vulnerability was found in code-projects Simple Photo Gall…9.8
• CVE-2025-68430CVAT is an open source interactive video and image annotatio…4.3
• CVE-2025-68432Zed, a code editor, has an aribtrary code execution vulnerab…7.3
• CVE-2025-68433Zed, a code editor, has an aribtrary code execution vulnerab…7.3
• CVE-2025-68434Open Source Point of Sale (opensourcepos) is a web based poi…8.8
• CVE-2025-68435Zerobyte is a backup automation tool Zerobyte versions prior…9.1
• CVE-2025-68436Craft is a platform for creating digital experiences. In ver…6.5
• CVE-2025-68437Craft is a platform for creating digital experiences. In ver…6.8