CVE-2026-41071 — Security Box Score

CVE · referencelatest edition

Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-41071MEDIUM

strukturag libheif — libheif: Heap buffer over-read in SampleAuxInfoReader via crafted HEIF sequence file with mismatched saiz sample count

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   A   L   N   L    5.1   .0030   22.8     —

AFFECTED
  Product  Versions    Fixed
  libheif  < 1.22.0 –  —

TIMELINE
  Apr 16  Reserved by GitHub_M
  May 22  EXPLOIT PUBLISHED — CVE-2026-41071 (strukturag libheif). Public exploit reference added.
  May 22  Published (CNA: GitHub_M)

CWE-125 · CNA: GitHub_M · CVSS v4.0 · 2 references · NVD status: Analyzed

Description

libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, a crafted HEIF sequence file where the saiz box declares more samples than actually exist in the track's chunk table causes a heap-buffer-overflow (out-of-bounds read) in the SampleAuxInfoReader constructor. The SampleAuxInfoReader constructor iterates over saiz->get_num_samples() samples but doesn't validate that this count is consistent with the number of chunks in the chunks vector. When saiz declares more samples than the chunks cover, the loop increments current_chunk past chunks.size(), causing an out-of-bounds read on the chunks vector. The vulnerability is triggered during file parsing (heif_context_read_from_file) without any additional user interaction. Any application using libheif to open untrusted HEIF files is affected. This issue has been fixed in version 1.22.0.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
April 16, 2026	Reserved	Reserved by GitHub_M
May 22, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-41071 (strukturag libheif). Public exploit reference added.
May 22, 2026	Published	Published (CNA: GitHub_M)

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
strukturag	libheif	—	< 1.22.0	—

Weaknesses

CWE-125

References (2)

https://github.com/strukturag/libheif/releases/tag/v1.22.0 [Product, Release Notes]
https://github.com/strukturag/libheif/security/advisories/GHSA-xj92-xjff-h8w3 [Exploit, Mitigation, Vendor Advisory]

Authoritative record: CVE-2026-41071 at cve.org

Vendors: strukturag

Weaknesses: CWE-125

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-41071 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.