CVE-2025-68431: 
NixOS vulnerability analysis and mitigation

CVE-2025-68431 is a heap buffer over-read vulnerability in libheif, an open-source HEIF and AVIF file format decoder and encoder. A crafted HEIF file that exercises the overlay image item (iovl) path triggers the flaw in HeifPixelImage::overlay(), leading to a crash and potential information disclosure. All versions up to and including 1.20.2 are affected; version 1.21.0 contains the fix. The vulnerability was disclosed on December 29, 2025, and carries a CVSS v3.1 base score of 7.1 (High) per NVD, or 6.5 (Medium) per the GitHub Security Advisory (GitHub Advisory, libheif v1.21.0).

The root cause is an integer underflow (CWE-190) leading to an out-of-bounds read (CWE-125) in HeifPixelImage::overlay() (pixelimage.cc). When processing an iovl overlay box, the function computes the per-row copy width as in_w - in_x0; if in_x0 is larger than in_w due to an unclipped overlay rectangle or invalid offsets, the result is negative. This negative value is then implicitly cast to size_t, producing a very large unsigned integer that is passed directly to memcpy, causing a massive heap over-read past the end of the allocated source plane. The specific one-line fix in commit b8c12a7 changes the memcpy length argument from in_w - in_x0 to in_w, eliminating the erroneous subtraction (GitHub Advisory, Fix Commit). The vulnerability was discovered via libFuzzer with AddressSanitizer on Ubuntu 20.04 and credited to Aldo Ristori (GitHub Advisory).

Successful exploitation causes a crash of the application processing the malicious HEIF file, resulting in denial of service. Additionally, because the over-read copies adjacent heap memory into the destination image buffer, there is a potential for limited information disclosure — heap contents from the process memory could be exposed depending on the allocator layout. The vulnerability affects any application that uses libheif ≤ 1.20.2 to decode user-supplied HEIF images, including image viewers, media processing pipelines, and web services that handle HEIF/AVIF uploads (GitHub Advisory).

No active in-the-wild exploitation has been reported, and CVE-2025-68431 is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.032% (0.000320), indicating a low probability of near-term exploitation. Exploitation requires user interaction — a victim must open or process a specially crafted HEIF file — but no authentication or special privileges are needed. The GitHub Security Advisory references a fuzzer-generated reproducer, and the fix commit is public, which could aid in crafting a proof-of-concept (GitHub Advisory).

1. Craft malicious HEIF file: Create a HEIF file containing an iovl (overlay image item) box with an overlay rectangle or offsets configured such that in_x0 > in_w, causing the computed copy width to be negative.
2. Deliver the file to the target: Distribute the crafted HEIF via email attachment, web upload, shared storage, or any channel where the target application will process it (e.g., an image viewer, thumbnail generator, or media server).
3. Trigger decoding: Cause the target application to decode the malicious HEIF file, invoking the call chain: heif_decode_image → HeifContext::decode_image → ImageItem_Overlay::decode_overlay_image → HeifPixelImage::overlay().
4. Trigger the over-read: The negative row width underflows to a huge size_t value and is passed to memcpy, reading far past the end of the allocated heap plane.
5. Achieve objective: The application crashes (denial of service), and depending on heap layout, adjacent heap memory may be copied into the destination image buffer, potentially leaking sensitive process data (GitHub Advisory, Fix Commit).

• File System: Presence of unexpected or externally sourced .heic, .heif, or .avif files with iovl overlay boxes in directories processed by libheif-based applications.
• Logs: Application crash logs or core dumps referencing HeifPixelImage::overlay, pixelimage.cc:1509, or ImageItem_Overlay::decode_overlay_image; AddressSanitizer output showing heap-buffer-overflow READ of very large size (e.g., 4294967280 bytes).
• Process: Unexpected termination (segfault/SIGABRT) of image processing services or viewers immediately after opening a HEIF file; abnormally large memcpy operations visible in system call traces (strace) from image-handling processes (GitHub Advisory).

Upgrade libheif to version 1.21.0 or later, which contains the one-line patch fixing the erroneous memcpy length calculation in pixelimage.cc (libheif v1.21.0, Fix Commit). Downstream Linux distributions including Ubuntu (USN-7952-1) and SUSE have released updated packages. As a temporary workaround where upgrading is not immediately possible, avoid decoding HEIF images that use iovl overlay boxes, or disable processing of overlay image items in the application layer (GitHub Advisory, Ubuntu Advisory).

The vulnerability was discovered through fuzzing (libFuzzer + AddressSanitizer) and responsibly disclosed by Aldo Ristori. The libheif maintainers patched it promptly in the v1.21.0 release on December 29, 2025, the same day as disclosure. Multiple Linux distributions (Ubuntu, SUSE, openSUSE) subsequently issued security advisories and updated packages. No significant broader media coverage or notable researcher commentary beyond the standard advisory process has been observed (GitHub Advisory, libheif v1.21.0, Ubuntu Advisory).