{"schemaVersion":3,"id":"CVE-2025-68431","aliases":["ALPINE-CVE-2025-68431","SUSE-SU-2026:0087-1","SUSE-SU-2026:20121-1","UBUNTU-CVE-2025-68431","DEBIAN-CVE-2025-68431","SUSE-SU-2026:0377-1","openSUSE-SU-2026:10019-1","openSUSE-SU-2026:20076-1"],"status":"published","duplicateOf":null,"title":null,"description":"libheif is an HEIF and AVIF file format decoder and encoder. Prior to version 1.21.0, a crafted HEIF that exercises the overlay image item path triggers a heap buffer over-read in `HeifPixelImage::overlay()`. The function computes a negative row length (likely from an unclipped overlay rectangle or invalid offsets), which then underflows when converted to `size_t` and is passed to `memcpy`, causing a very large read past the end of the source plane and a crash. Version 1.21.0 contains a patch. As a workaround, avoid decoding images using `iovl` overlay boxes.","dates":{"published":"2025-12-29T19:09:54.628Z","modified":"2025-12-30T22:26:20.374Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":7.1,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"NVD","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":6.5,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Alpine","score":7.1,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","exploitability":7.2,"impact":7,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Ubuntu","score":7.1,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","exploitability":7.2,"impact":7,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Debian","score":7.1,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","exploitability":7.2,"impact":7,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":7.1,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00427,"percentile":0.35572,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0.09500000000000003,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.00332},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.0034,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.0034,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.0034,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.0034,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.0034,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.0034,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00427,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00427,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00427,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00427,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00427,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00427,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00427,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00427,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00427,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00427,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00427,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00427,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00427,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00427,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00427,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00427,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00427,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00427,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00427,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00427,"percentile":0.35572}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.0034,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.0034,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.0034,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.0034,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.0034,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.0034,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00427,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00427,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00427,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00427,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00427,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00427,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00427,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00427,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00427,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00427,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00427,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00427,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00427,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00427,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00427,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00427,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00427,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00427,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00427,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00427,"percentile":0.35572}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"GITHUB_STRUKTURAG_LIBHEIF","name":"Libheif","source":"github","url":"https://github.com/strukturag/libheif/issues/123","maturity":"poc","reliabilityScore":0.3,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null}],"exploitCount":1,"weaknesses":[{"id":"CWE-125","name":"Out-of-bounds Read","description":"The product reads data past the end, or before the beginning, of the intended buffer.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/125.html"},{"id":"CWE-190","name":"Integer Overflow or Wraparound","description":"The product performs a calculation that can\n         produce an integer overflow or wraparound when the logic\n         assumes that the resulting value will always be larger than\n         the original value. This occurs when an integer value is\n         incremented to a value that is too large to store in the\n         associated representation. When this occurs, the value may\n         become a very small or negative number.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"Medium","url":"https://cwe.mitre.org/data/definitions/190.html"}],"affected":[{"vendor":"alpine","product":"libheif","name":"libheif","label":"libheif","ecosystem":"Alpine Linux","cpePart":null,"purl":"pkg:apk/alpine/libheif","purlType":"apk","versions":[{"text":"< 1.21.2-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.21.2-r0","eol":null,"hubHref":null},{"vendor":"debian","product":"libheif","name":"libheif","label":"libheif","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/libheif","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null},{"text":"< 1.19.8-1+deb13u1","noFixRecorded":false,"fixedIn":null},{"text":"< 1.21.2-1","noFixRecorded":false,"fixedIn":null}],"versionsText":"All versions (No fix recorded) | < 1.19.8-1+deb13u1 | < 1.21.2-1","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"libheif","name":"libheif","label":"libheif","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/libheif","purlType":"deb","versions":[{"text":"< 1.1.0-2ubuntu0.1~esm2","noFixRecorded":false,"fixedIn":null},{"text":"< 1.6.1-1ubuntu0.1~esm2","noFixRecorded":false,"fixedIn":null},{"text":"< 1.12.0-2ubuntu0.1~esm2","noFixRecorded":false,"fixedIn":null},{"text":"< 1.17.6-1ubuntu4.2","noFixRecorded":false,"fixedIn":null},{"text":"< 1.20.2-1ubuntu0.1","noFixRecorded":false,"fixedIn":null},{"text":"< 1.21.2-1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.1.0-2ubuntu0.1~esm2 | < 1.6.1-1ubuntu0.1~esm2 | < 1.12.0-2ubuntu0.1~esm2 | < 1.17.6-1ubuntu4.2 | < 1.20.2-1ubuntu0.1 | < 1.21.2-1","eol":null,"hubHref":null},{"vendor":"opensuse","product":"libheif&distro=openSUSE Leap 15.6","name":"libheif","label":"libheif&distro=openSUSE Leap 15.6","ecosystem":"openSUSE","cpePart":null,"purl":"pkg:rpm/opensuse/libheif&distro=openSUSE Leap 15.6","purlType":"rpm","versions":[{"text":"< 1.12.0-150400.3.17.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.12.0-150400.3.17.1","eol":null,"hubHref":null},{"vendor":"opensuse","product":"libheif&distro=openSUSE Leap 16.0","name":"libheif","label":"libheif&distro=openSUSE Leap 16.0","ecosystem":"openSUSE","cpePart":null,"purl":"pkg:rpm/opensuse/libheif&distro=openSUSE Leap 16.0","purlType":"rpm","versions":[{"text":"< 1.19.7-160000.3.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.19.7-160000.3.1","eol":null,"hubHref":null},{"vendor":"opensuse","product":"libheif&distro=openSUSE Tumbleweed","name":"libheif","label":"libheif&distro=openSUSE Tumbleweed","ecosystem":"openSUSE","cpePart":null,"purl":"pkg:rpm/opensuse/libheif&distro=openSUSE Tumbleweed","purlType":"rpm","versions":[{"text":"< 1.21.1-1.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.21.1-1.1","eol":null,"hubHref":null},{"vendor":"suse","product":"libheif&distro=SUSE Linux Enterprise Module for Desktop Applications 15 SP7","name":"libheif","label":"libheif&distro=SUSE Linux Enterprise Module for Desktop Applications 15 SP7","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/libheif&distro=SUSE Linux Enterprise Module for Desktop Applications 15 SP7","purlType":"rpm","versions":[{"text":"< 1.19.5-150700.3.3.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.19.5-150700.3.3.1","eol":null,"hubHref":null},{"vendor":"suse","product":"libheif&distro=SUSE Linux Enterprise Module for Package Hub 15 SP7","name":"libheif","label":"libheif&distro=SUSE Linux Enterprise Module for Package Hub 15 SP7","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/libheif&distro=SUSE Linux Enterprise Module for Package Hub 15 SP7","purlType":"rpm","versions":[{"text":"< 1.19.5-150700.3.3.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.19.5-150700.3.3.1","eol":null,"hubHref":null},{"vendor":"suse","product":"libheif&distro=SUSE Linux Enterprise Server 16.0","name":"libheif","label":"libheif&distro=SUSE Linux Enterprise Server 16.0","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/libheif&distro=SUSE Linux Enterprise Server 16.0","purlType":"rpm","versions":[{"text":"< 1.19.7-160000.3.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.19.7-160000.3.1","eol":null,"hubHref":null},{"vendor":"suse","product":"libheif&distro=SUSE Linux Enterprise Server for SAP applications 16.0","name":"libheif","label":"libheif&distro=SUSE Linux Enterprise Server for SAP applications 16.0","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/libheif&distro=SUSE Linux Enterprise Server for SAP applications 16.0","purlType":"rpm","versions":[{"text":"< 1.19.7-160000.3.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.19.7-160000.3.1","eol":null,"hubHref":null},{"vendor":"struktur","product":"libheif","name":"libheif","label":"libheif","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 1.21.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.21.0","eol":null,"hubHref":"/vendor/struktur/libheif"},{"vendor":"strukturag","product":"libheif","name":"libheif","label":"libheif","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 1.21.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.21.0","eol":null,"hubHref":"/vendor/strukturag/libheif"}],"affectedCount":12,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/strukturag/libheif/security/advisories/GHSA-j87x-4gmq-cqfq","label":"github.com/strukturag/libheif/security/advisories/GHSA-j87x-4gmq-cqfq","hostname":"github.com","tags":["X Refsource CONFIRM","REPORT","Exploit","Patch","Vendor Advisory"]},{"url":"https://github.com/strukturag/libheif/commit/b8c12a7b70f46c9516711a988483bed377b78d46","label":"github.com/strukturag/libheif/commit/b8c12a7b70f46c9516711a988483bed377b78d46","hostname":"github.com","tags":["X Refsource MISC","Patch"]},{"url":"https://github.com/strukturag/libheif/releases/tag/v1.21.0","label":"github.com/strukturag/libheif/releases/tag/v1.21.0","hostname":"github.com","tags":["X Refsource MISC","REPORT","Product","Release Notes"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2025-68431","label":"security.alpinelinux.org/vuln/CVE-2025-68431","hostname":"security.alpinelinux.org","tags":["Advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260087-1/","label":"www.suse.com/support/update/announcement/2026/suse-su-20260087-1/","hostname":"www.suse.com","tags":["Advisory"]},{"url":"https://bugzilla.suse.com/1255735","label":"bugzilla.suse.com/1255735","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68431","label":"www.suse.com/security/cve/CVE-2025-68431","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620121-1/","label":"www.suse.com/support/update/announcement/2026/suse-su-202620121-1/","hostname":"www.suse.com","tags":["Advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-68431","label":"ubuntu.com/security/CVE-2025-68431","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-68431","label":"www.cve.org/CVERecord?id=CVE-2025-68431","hostname":"www.cve.org","tags":["REPORT"]},{"url":"https://ubuntu.com/security/notices/USN-7952-1","label":"ubuntu.com/security/notices/USN-7952-1","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-68431","label":"security-tracker.debian.org/tracker/CVE-2025-68431","hostname":"security-tracker.debian.org","tags":["Advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260377-1/","label":"www.suse.com/support/update/announcement/2026/suse-su-20260377-1/","hostname":"www.suse.com","tags":["Advisory"]}],"lineage":{"upstream":[],"downstream":["OPENSUSE-SU-2026:20974-1","SUSE-SU-2026:22153-1","SUSE-SU-2026:2622-1","USN-7952-1"],"duplicates":[],"related":["OPENSUSE-SU-2026:20974-1","SUSE-SU-2026:22153-1","SUSE-SU-2026:2622-1","USN-7952-1"]},"timeline":[{"kind":"published","date":"2025-12-29T19:09:54.628Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2025-12-30T22:26:20.374Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":38,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T06:49:35.147Z","stale":false,"partial":false}}