Vulnerability

[ Why it matters ]Priority signals

• Public proof-of-concept exploit exists (CISA SSVC)

[ Description ]Official description

In Libheif 1.17.6, insufficient checks in ImageOverlay::parse() decoding a heif file containing an overlay image with forged offsets can lead to an out-of-bounds read and write.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• NCSC-NL22 Oct 2026NCSC-2026-0448

  Vulnerabilities fixed in Oracle Fusion Middleware Translated from Dutch

  Probability/damage H/HCVE-2026-54513CVE-2026-56741CVE-2026-59649+191 more CVEs
• BSI CERT-Bund20 Oct 2026WID-SEC-2026-4078

  Oracle Fusion Middleware: Multiple vulnerabilities Translated from German

  CVE-2026-91212CVE-2023-43622CVE-2026-42779+191 more CVEs

[ References ]References

• github.com/strukturag/libheif/issues/1226
• github.com/strukturag/libheif/pull/1227
• github.com/strukturag/libheif/commit/a3ed1b1eb178c5d651d6ac619c8da3d71ac2be36
• gist.github.com/flyyee/79f1b224069842ee320115cafa5c35c0