CVE-2025-68431 libheif has Potential Heap Buffer Over-Read
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2025-68431?
CVE-2025-68431 is a medium-severity vulnerability in strukturag libheif, published on 29 Dec 2025.
Official description
libheif is an HEIF and AVIF file format decoder and encoder. Prior to version 1.21.0, a crafted HEIF that exercises the overlay image item path triggers a heap buffer over-read in `HeifPixelImage::overlay()`. The function computes a negative row length (likely from an unclipped overlay rectangle or invalid offsets), which then underflows when converted to `size_t` and is passed to `memcpy`, causing a very large read past the end of the source plane and a crash. Version 1.21.0 contains a patch. As a workaround, avoid decoding images using `iovl` overlay boxes.
Which versions are affected by CVE-2025-68431?
It affects 1 product.
Linux distribution packages (7)
libheif SUSE:Linux Enterprise Module for Desktop Applications 15 SP7 | All versions | 1.19.5-150700.3.3.1 |
libheif SUSE:Linux Enterprise Module for Package Hub 15 SP7 | All versions | 1.19.5-150700.3.3.1 |
libheif SUSE:Linux Enterprise Server 16.0 | All versions | 1.19.7-160000.3.1 |
libheif SUSE:Linux Enterprise Server for SAP applications 16.0 | All versions | 1.19.7-160000.3.1 |
libheif openSUSE:Leap 15.6 | All versions | 1.12.0-150400.3.17.1 |
libheif openSUSE:Leap 16.0 | All versions | 1.19.7-160000.3.1 |
libheif openSUSE:Tumbleweed | All versions | 1.21.1-1.1 |
Products include Struktur Libheif.
How do I fix CVE-2025-68431?
Upgrade to a fixed version.
Is CVE-2025-68431 being exploited?
There is no known exploitation of CVE-2025-68431 in the wild and no public exploit code.
Other vulnerabilities in strukturag libheif
Sources
Also known as ALPINE-CVE-2025-68431, DEBIAN-CVE-2025-68431, ECHO-d777-8afd-de52, GHSA-j87x-4gmq-cqfq, JLSEC-2026-156, ROOT-OS-DEBIAN-11-CVE-2025-68431 and 7 more.