ECHO-ff10-c876-4faa
See a problem?- Import Source
- https://advisory.echohq.com/osv/ECHO-ff10-c876-4faa.json
- JSON Data
- https://api.osv.dev/v1/vulns/ECHO-ff10-c876-4faa
- Upstream
- Withdrawn
- 2026-07-15T08:15:03Z
- Published
- 2026-05-26T09:52:21Z
- Modified
- 2026-09-15T03:33:45Z
- Summary
- Out-of-bounds read in core image-sequence parsing: a malformed HEIF sequence with stco.entry_count == 0 and saiz.sample_count > 0 drives SampleAuxInfoReader to dereference an empty chunks[0]. This sequence / ISOBMFF track parsing (SampleAuxInfoReader, Box_saiz/saio/stco, TrackBox/MovieBox) was added in v1.20.0. v1.19.8 — the version we ship — has no track parsing at all, so the vulnerable code is not present (verified: none of those symbols exist in the v1.19.8 source).
- Details
- References