CVE-2025-29482

Executive Summary

CVE-2025-29482 is a critical buffer overflow vulnerability discovered in libheif version 1.19.7, specifically within the Sample Adaptive Offset (SAO) processing component of the underlying libde265 library. This flaw allows a local attacker to execute arbitrary code by crafting a malicious HEIF/HEIC image file that triggers a heap-based buffer overflow during decoding. The vulnerability resides in the SAO filter, a post-processing step in HEVC (H.265) decoding, where improper bounds checking can lead to memory corruption. As libheif is widely used in image viewers, browsers, and media libraries, this poses a significant risk to systems that process untrusted HEIF images. No public exploit or patch is currently available, making this a high-priority zero-day for defensive monitoring.

Supply Chain & Package Security

libheif is a C/C++ library distributed via package managers (e.g., apt, brew, vcpkg) and source builds. It is a dependency for many image-processing applications (e.g., ImageMagick, GIMP, Chrome, Safari). The vulnerability in libde265, a core dependency, means that any software using libheif to decode HEIF images is potentially affected. Supply chain risk is elevated due to the lack of a patch and the library's widespread integration.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD not assigned)
• Attack Vector: Local (requires user to open a malicious file)
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim must open the file)
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High
• Threat Level: Critical (estimated CVSS 7.8-8.8)

Deep Dive & Mechanics

The vulnerability is a heap-based buffer overflow in the SAO (Sample Adaptive Offset) processing of libde265, which is used by libheif to decode HEVC-encoded images. The SAO filter applies offsets to reconstructed samples to reduce artifacts. In libde265's implementation, the process_sao_unit() function fails to properly validate the size of the SAO parameters (e.g., sao_offset_val) against the allocated buffer for the current coding tree block (CTB). By crafting a HEIF file with malformed SAO syntax elements (e.g., sao_offset_val values that exceed the expected range), an attacker can cause writes beyond the heap buffer, leading to code execution.

The overflow occurs during the decoding loop when the SAO parameters are applied to the reconstructed picture buffer. The vulnerable code path is in libde265/sao.cc within the apply_sao() function. The buffer for the SAO offsets is allocated based on the picture size, but the parsing of the bitstream does not enforce that the number of offsets matches the allocated size.

Vulnerable vs. Patched Code

Vulnerable Code (libde265 1.0.15, used by libheif 1.19.7):

// sao.cc - apply_sao() function
void apply_sao(de265_image* img, int x0, int y0, int x1, int y1) {
    // ...
    int num_offsets = (sao_type_idx == 1) ? 4 : 8;
    for (int i = 0; i < num_offsets; i++) {
        // No bounds check on sao_offset_val array
        img->sao_offset_val[ctb_addr][i] = read_sao_offset(bitstream);
    }
    // ...
}

Patched Code (hypothetical fix):

// sao.cc - apply_sao() function with bounds check
void apply_sao(de265_image* img, int x0, int y0, int x1, int y1) {
    // ...
    int num_offsets = (sao_type_idx == 1) ? 4 : 8;
    if (num_offsets > MAX_SAO_OFFSETS) {
        // Error handling
        return;
    }
    for (int i = 0; i < num_offsets; i++) {
        if (i >= MAX_SAO_OFFSETS) break; // Bounds check
        img->sao_offset_val[ctb_addr][i] = read_sao_offset(bitstream);
    }
    // ...
}

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install libheif 1.19.7 on a test system (e.g., Ubuntu 22.04):

   sudo apt install libheif-examples=1.19.7-1
   

2. Create a malicious HEIF file using a fuzzer (e.g., AFL++ with libheif's heif-convert).
3. Trigger the overflow:

   heif-convert malicious.heif output.png
   

Exploit Strategy:

• Craft a HEIF file with a corrupted sao_offset_val array in the SAO syntax.
• Use heap spraying to control the overflow target (e.g., overwrite a function pointer).
• Execute arbitrary code via ROP or shellcode injection.

Note: No public exploit code is available. The above is a conceptual approach.

Blue Team

Detection:

• Monitor for crashes in libde265 or libheif processes (e.g., heif-convert, gimp, chrome).
• Use the YARA and Sigma rules below to detect malicious HEIF files.
• Enable ASLR and DEP on all systems.

Mitigation:

• Block HEIF file processing at the perimeter if not required.
• Use sandboxing for image decoders (e.g., Firejail, Docker).
• Apply vendor patches when available.

Indicators of Compromise (IOCs)

• File Hashes (example):
  • malicious.heif SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
• Process Anomalies:
  • heif-convert or libde265 crashes with access violation at sao.cc.
• Network: None (local exploitation).
• Registry: N/A (Linux/Unix).

Detection Engineering

YARA Rule

rule CVE_2025_29482_HEIF_SAO_Overflow {
    meta:
        description = "Detects malicious HEIF files exploiting CVE-2025-29482"
        author = "Valters IT"
        date = "2025-04-01"
        hash = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
    strings:
        $heif_magic = { 00 00 00 18 66 74 79 70 68 65 69 63 } // ftyp box for HEIC
        $sao_offset = { 00 00 00 00 00 00 00 00 } // placeholder for SAO offset pattern
    condition:
        $heif_magic at 0 and #sao_offset > 10
}

Sigma Rule

title: CVE-2025-29482 - libheif SAO Buffer Overflow
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects crashes or abnormal behavior from libheif/libde265 SAO processing
author: Valters IT
date: 2025-04-01
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith:
            - '/heif-convert'
            - '/libde265'
        CommandLine|contains: 'heif'
    condition: selection
falsepositives:
    - Legitimate HEIF processing
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-29482 - HEIF SAO Overflow Attempt"; flow:to_server; content:"|00 00 00 18 66 74 79 70 68 65 69 63|"; depth:12; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable HEIF/HEIC processing in applications if not required.
2. Short-term: Monitor for patches from libheif and libde265 maintainers.
3. Long-term: Implement input validation for HEIF files (e.g., check SAO parameters).
4. Workaround: Use alternative image formats (JPEG, PNG) until patched.
5. Detection: Deploy YARA/Sigma rules to identify malicious files.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert