CVE-2026-41071

libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, a crafted HEIF sequence file where the saiz box declares more samples than actually exist in the track's chunk table causes a heap-buffer-overflow (out-of-bounds read) in the SampleAuxInfoReader constructor. The SampleAuxInfoReader constructor iterates over saiz->get_num_samples() samples but doesn't validate that this count is consistent with the number of chunks in the chunks vector. When saiz declares more samples than the chunks cover, the loop increments current_chunk past chunks.size(), causing an out-of-bounds read on the chunks vector. The vulnerability is triggered during file parsing (heif_context_read_from_file) without any additional user interaction. Any application using libheif to open untrusted HEIF files is affected. This issue has been fixed in version 1.22.0.

• CWE-125

• https://github.com/strukturag/libheif/releases/tag/v1.22.0Product, Release Notes
• https://github.com/strukturag/libheif/security/advisories/GHSA-xj92-xjff-h8w3Exploit, Mitigation, Vendor Advisory

Published

May 22, 2026

Last Modified

Jul 23, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-41066lxml is a library for processing XML and HTML in the Python …7.5
• CVE-2026-41067Astro is a web framework. Prior to 6.1.6, the defineScriptVa…6.1
• CVE-2026-41068Kyverno is a policy engine designed for cloud native platfor…7.7
• CVE-2026-41069libheif is a HEIF and AVIF file format decoder and encoder. …6.5
• CVE-2026-4107Zohocorp ManageEngine Exchange Reporter Plus versions before…5.4
• CVE-2026-41070openvpn-auth-oauth2 is a plugin/management interface client …10
• CVE-2026-41073RT is an open source, enterprise-grade issue and ticket trac…4.6
• CVE-2026-41074RT is an open source, enterprise-grade issue and ticket trac…7.1
• CVE-2026-41075RT is an open source, enterprise-grade issue and ticket trac…8.8
• CVE-2026-41076RT is an open source, enterprise-grade issue and ticket trac…8.1
• CVE-2026-41078OpenTelemetry dotnet is a dotnet telemetry framework. In 1.6…5.9
• CVE-2026-41079OpenPrinting CUPS is an open source printing system for Linu…5.4