CVE-2026-48029: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-48029 is a heap out-of-bounds read vulnerability in libheif's ImageItem_Grid::decode_grid_tile function, triggered by an integer underflow in tile-coordinate calculations when processing HEIF/HEIC files containing grid-derived items with an irot (rotation) property. It affects libheif versions v1.19.0 through v1.21.2, and was discovered and reported by security researcher Ariel Koren. The vulnerability was published as a GitHub Security Advisory on May 20, 2026, and patched in libheif v1.22.0. It carries a CVSS v3.1 score of 7.1 (High) (GitHub Advisory, Ubuntu Advisory).

The root cause is a uint32_t integer underflow (CWE-191) in ImageItem::transform_requested_tile_position_to_original_tile_position (image_item.cc:604+), where subtractions such as tiling.num_columns - 1 - tile_y (for 90° rotation) are performed without first validating that tile_x/tile_y are within the post-rotation tile-grid bounds. When an irot property swaps rows and columns in a non-square grid, the subtraction underflows to approximately UINT32_MAX. This enormous coordinate is then passed to ImageItem_Grid::decode_grid_tile (grid.cc:584+), which computes idx = ty * cols + tx and indexes m_grid_tile_ids with no runtime bounds check — a guard assert is compiled out in NDEBUG/release builds, resulting in a real heap OOB read (CWE-125). Exploitation requires an attacker to supply a crafted HEIF/HEIC file to a victim application that decodes it, triggering the flaw via heif_image_handle_decode_image_tile or heif_decode_image (GitHub Advisory).

The primary impact is a reliable denial-of-service (DoS): the OOB read overshoots into unmapped memory, causing a SIGSEGV crash in any application that opens an attacker-supplied HEIF/HEIC file. There is also a limited confidentiality risk — the 4-byte heap OOB read retrieves a heif_item_id value at an attacker-influenced offset, which could theoretically be leveraged in a larger exploit chain for information disclosure, though the researcher assessed this as not a trivially leaking primitive on its own. Integrity is not directly affected (GitHub Advisory, Ubuntu Advisory).

1. Craft a malicious HEIF/HEIC file: Create a HEIF file containing a grid-derived image item with an irot rotation property set to 90°, 180°, or 270°, where the grid has unequal rows and columns (non-square). This causes the tile-coordinate transform to underflow.
2. Deliver the file to a target: Distribute the crafted file via email attachment, web upload, messaging app, or any vector that causes a libheif-linked application (e.g., image viewer, thumbnailer, photo editor) to open and decode it.
3. Trigger decoding: The victim application calls heif_decode_image or heif_image_handle_decode_image_tile, which internally invokes ImageItem::transform_requested_tile_position_to_original_tile_position with the malicious tile coordinates.
4. Trigger integer underflow: The uint32_t subtraction (e.g., tiling.num_columns - 1 - tile_y) underflows to ~UINT32_MAX due to the rotation-induced dimension swap.
5. Trigger heap OOB read: The inflated coordinate is passed to ImageItem_Grid::decode_grid_tile, which computes a massive idx and reads 4 bytes far outside the m_grid_tile_ids vector, causing a SIGSEGV crash (DoS) in release builds (GitHub Advisory).

• Process: Unexpected crash (SIGSEGV) of any application linked against libheif (e.g., image viewers, thumbnailers, media processors) when opening a HEIF/HEIC file.
• Logs: Application crash logs or core dumps referencing ImageItem_Grid::decode_grid_tile (grid.cc:588) or heif_image_handle_decode_image_tile in the stack trace.
• File System: Presence of crafted .heic or .heif files with irot rotation properties and non-square grid dimensions in directories processed by libheif-linked applications.
• Network: Unusual inbound delivery of HEIF/HEIC files from untrusted sources to services that auto-process images (e.g., upload endpoints, thumbnail generators) (GitHub Advisory).

The vulnerability is fixed in libheif v1.22.0, which includes two-part remediation: (A) input validation of tile_x/tile_y against post-rotation bounds before the uint32_t subtractions in transform_requested_tile_position_to_original_tile_position, and (B) replacement of the assert in decode_grid_tile with a runtime bounds check returning heif_error_Invalid_input. Ubuntu has released patched packages: libheif1 1.21.2-3ubuntu0.3 for Ubuntu 26.04 LTS and libheif1 1.20.2-1ubuntu0.6 for Ubuntu 25.10. SUSE has also issued security updates (SUSE-SU-2026:2622-1). Users should upgrade to libheif v1.22.0 or apply the relevant OS vendor security update as soon as possible (GitHub Advisory, Ubuntu Advisory, SUSE Advisory).

The vulnerability was discussed on Reddit's r/blueteamsec community under the title "CVE-2026-48029: Two griddecode bugs in libheif," indicating moderate security community interest. The Solus Linux project also noted the issue in their weekly security roundup. The researcher (Ariel Koren) published a detailed write-up on their personal site. No major vendor statements beyond the patch advisories have been identified (Reddit, Ariel Koren).