CVE Wiki Pixee · CVE intelligence
← All CVEs

CVE-2025-62821

Critical · CVSS 9.1

Microsoft HEIF Image Extensions — Out-of-bounds read (OOB read) via undersized buffer allocation in image copy path

CVSS
9.1
nvd
EPSS
—
KEV
No
Class
other
CWE-125

Description

Microsoft HEIF Image Extensions 1.2.22.0 has an out-of-bounds read because CHEIFItemInfoEntry_GetDataSize can return success while leaving the reported data size as 0. This causes a caller to make a 1-byte allocation. Later, CopyPixels computes copy_size = stride * abs(roi_height) but does not check the source buffer length before a memmove call.

Search profile — drives PoC discovery

Symbols CHEIFItemInfoEntry_GetDataSizeCopyPixelscopy_sizestrideroi_heightmemmoveabs(roi_height)
Keywords CVE-2025-62821Microsoft HEIF Image ExtensionsCHEIFItemInfoEntry_GetDataSizeCopyPixelsout-of-bounds readHEIF OOB1-byte allocationmemmove OOBHEIF Extensions 1.2.22.0
Versions: 1.2.22.0

Ranked PoCs (1) — best first

Heuristic ranking — not yet expert-vetted. Scored on structure + provenance, not execution.

Recall-favoring discovery; ranking by the Stage-4 scorer (Adam's rubric). Scanner/aggregator repos are hidden.

References

Status: enriched · ingested 2026-07-01T00:00:14.000Z · profiled 2026-07-01T00:30:14.000Z