Heap buffer overflow in scale_nearest_neighbor() via duplicate Alpha planes from nested iden/auxl items

Vendor

strukturag

Product

libheif

Affected versions

<= v1.23.1; fixed in v1.23.2

CVSS

9.8

Published

2026-08-25 11:17

Collected

2026-08-28 06:53

---
id: 6753
title: "Heap buffer overflow in scale_nearest_neighbor() via duplicate Alpha planes from nested iden/auxl items"
cvss: 9.8
severity: critical
vendor: "strukturag"
product: "libheif"
affected_versions: "<= v1.23.1; fixed in v1.23.2"
source_domain: github.com
source_url: "https://github.com/strukturag/libheif/security/advisories/GHSA-g89c-p67h-r497"
published_at: "2026-08-25T11:17:10Z"
tags: ["rce", "memory-corruption", "vulnerability", "heap-buffer-overflow", "image-parsing", "heic", "libheif", "heap-overflow", "ghsa-g89c-p67h-r497", "isobmff"]
phying_url: "https://phying.com/item/6753"
lang: en
---

# Heap buffer overflow in scale_nearest_neighbor() via duplicate Alpha planes from nested iden/auxl items

## Summary

Critical libheif heap overflow (GHSA-g89c-p67h-r497): nested iden/auxl items duplicate Alpha planes so scaling writes 16-bit samples into a 1-byte buffer; a crafted five-item ISOBMFF file triggers it.

## Why it matters

A critical, network-reachable image-decoding flaw can turn an attacker-supplied HEIC/HEIF/AVIF file into code execution; upgrade libheif to v1.23.2.

## Intelligence Metadata

- **Sources:** github.com
- **CVSS:** 9.8
- **Vendor:** strukturag
- **Product:** libheif
- **Affected versions:** <= v1.23.1; fixed in v1.23.2
- **Published:** 2026-08-25T11:17:10Z
- **Original:** https://github.com/strukturag/libheif/security/advisories/GHSA-g89c-p67h-r497
- **Phying News:** https://phying.com/item/6753