libheif Heap Buffer Overflow in decode_slice_unit_WPP (CVE-2026-45383)

Vulnerability Overview A heap buffer overflow (out-of-bounds read) vulnerability exists in the function of . When decoding WPP (Wavefront Parallel Processing) HEVC slices, the value is calculated as within the entry loop. If the PPS/SPS headers are crafted such that this value exceeds , the subsequent array access will read past the end of the allocated vector, triggering a heap buffer overflow confirmed by AddressSanitizer. Impact Scope Affected Versions: (The current main branch as of 2026-03-27 is also affected). CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Confidentiality: None - Integrity: None - Availability: High CVE ID: CVE-2026-45383 Remediation Fixed Version: Vulnerable Code ASan Output ```plaintext ==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x507000000230 READ of size 4 at 0x507000000230 thread T0 #0 decoder_context::decode_slice_unit_WPP() #1 decoder_context::decode_slice_unit_parallel(image_unit, slice_unit) #2 decoder_context::decode_some(bool&) #3 decoder_context::read_slice_NAL(bitstream&, nal_unit&, nal_header&) #4 decoder_context::decode(NAL_unit) #5 decoder_context::decode(NAL_unit) #6 libheif_v1::decode_next_image() #7 libheif/plugins/decoder/libheif_v1.cc:382 0x507000000230 is located 0 bytes after 80-byte region [0x5070000001e0,0x507000000230) allocated by: pic_parameter_set_derived_values() — pps.ctbAddrRSToTS.resize(...) SUMMARY: AddressSanitizer: heap-buffer-overflow decoder_context::decode_slice_unit_WPP() — decoder_context::decode_slice_unit_WPP() — decoder_context::decode_slice_unit_WPP() — decoder_context::decode_slice_unit_WPP() — decoder_context::decode_slice_unit_WPP() — decoder_context::decode_slice_unit_WPP() — decoder_context::decode_slice_unit_WPP() — decoder_context::decode_slice_unit_WPP() — decoder_context::decode_slice_unit_WPP() — decoder_context::decode_slice_unit_WPP() — decoder_context::decode_slice_unit_WPP() — decoder_context::decode_slice_unit_WPP() — decoder_context::decode_slice_unit_WPP() — decoder_context::decode_slice_unit_WPP() — decoder_context::decode_slice_unit_WPP() — decoder_context::decode_slice_unit_WPP() — decoder_context::decode_slice_unit_WPP() — decoder_context::decode_slice_unit_WPP() — decoder_context::decode_slice_unit_WPP() — decoder_context::decode_slice_unit_WPP() — decoder_context::decode_slice_unit_WPP() — decoder_context::decode_slice_unit_WPP() — decoder_context::decode_slice_unit_WPP() — decoder_context::decode_slice_unit_WPP() — decoder_context::decode_slice_unit_WPP() — decoder_context::decode_slice_unit_WPP() — decoder_context::decode_slice_unit_WPP() — decoder_context::decode_slice_unit_WPP() — decoder_context::decode_slice_unit_WPP() — decoder_context::decode_slice_unit_WPP() — decoder_context::decode_slice_unit_WPP() — decoder_context::decode_slice_unit_WPP() — decoder_context::decode_slice_unit_WPP() — decoder_context::decode_slice_unit_WPP() — decoder_context::decode_slice_unit_WPP() — decoder_context::decode_slice_unit_WPP() — decoder_context::decode_slice_unit_WPP() — decoder_context::decode_slice_unit_WPP() — decoder_context::decode_slice_unit_WPP() — decoder_context::decode_slice_unit_WPP() — decoder_context::decode_slice_unit_WPP() — decoder_context::decode_slice_unit_WPP() — decoder_context::decode_slice_unit_WPP() — decoder_context::decode_slice_unit_WPP() — decoder_context::decode_slice_unit_WPP() — decoder_context::decode_slice_unit_WPP() — decoder_context::decode_slice_unit_WPP() — decoder_context::decode_slice_unit_WPP() — decoder_context::decode_slice_unit_WPP() — decoder_context::decode_slice_unit_WPP() — decoder_context::decode_slice_unit_WPP() — decoder_context::decode_slice_unit_WPP() — decoder_context::decode_slice_unit_WPP() — decoder_context::decode_slice_unit_WPP() — decoder_context::decode_slice_unit_WPP() — decoder_context::decode_slice_unit_WPP() — decoder_context::decode_slice_unit_WPP() — decoder_context::decode_slice_unit_WPP() — decoder_context::decode_slice_unit_WPP() — decoder_context::decode_slice_unit_WPP() — decoder_context::decode_slice_unit_WPP() — decoder_context::decode_slice_unit_WPP() — decoder_context::decode_slice_unit_WPP() — decoder_context::decode_slice_unit_WPP() — decoder_context::decode_slice_unit_WPP() — decoder_context::decode_slice_unit_WPP() — decoder_context::decode_slice_unit_WPP() — decoder_context::decode_slice_unit_WPP() — decoder_context::decode_slice_unit_WPP() — decoder_context::decode_slice_unit_WPP() — decoder_context::decode_slice_unit_WPP() — decoder_context::decode_slice_unit_WPP() — decoder_context::decode_slice_unit_WPP() — decoder_context::decode_slice_unit_WPP() — decoder_context::decode_slice_unit_WPP() — decoder_context::decode_slice_unit_WPP() — decoder_context::decode_slice_unit_WPP() — decoder_context::decode_slice_unit_WPP() — decoder_context::decode_slice_unit_WPP() — decoder_context::decode_slice_unit_WPP() — decoder_context::decode_

Goal Reached Thanks to every supporter — we hit 100%!

libheif Heap Buffer Overflow in decode_slice_unit_WPP (CVE-2026-45383)

More from this source