Heap-based buffer overflow in Microsoft HEIF Image Extension enables local code execution

Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code locally.

• Microsoft HEIF Image Extension: the normalized record identifies version 1.0.0.0 as affected with an upper boundary of versions less than 1.2.48.0.
• The supplied data does not describe additional parallel release branches or deployment configurations.
• The status of versions and branches outside the recorded affected range should not be inferred.

Microsoft HEIF Image Extension uses the Microsoft Windows Codecs Library, where a heap-based buffer overflow is identified. The record classifies the weakness as CWE-122 and states that the attacker does not need prior privileges but does require user interaction in a local context. Local code execution is the stated consequence, but the supplied evidence does not disclose the triggering input, vulnerable processing path, or the implementation details that would control execution. The affected scope is described as unchanged from the vulnerable component.

• Exploitation is local and has low complexity according to the supplied information.
• The attacker does not need prior authentication, but user interaction is required.
• The record marks public exploit as false. Actual exploitation status is not confirmed in the record because the known-exploited field has no value.
• No exploit procedure, payload, or specific exploitation indicator is provided.

• The flaw may result in local code execution on systems using Microsoft HEIF Image Extension.
• The supplied impact characteristics indicate potentially high effects on confidentiality, integrity, and availability if exploitation succeeds.
• Scope is unchanged because the described impact remains within the vulnerable component's scope.
• Exploitation requires user interaction and is not described as a direct remote attack path. The specific privileges obtainable after exploitation are not established by the supplied evidence.

• Successful exploitation may allow code to run on an endpoint processing content through Microsoft HEIF Image Extension.
• Potential organisational consequences include loss of data confidentiality, unauthorised data modification, or disruption of system availability, depending on the privileges of the affected process.
• Because user interaction is required, exposure is concentrated on endpoints where users process untrusted image content.
• The record does not identify a specific intrusion, campaign, victim, or data breach.

1. Apply Microsoft's security update for Microsoft HEIF Image Extension to systems within the affected range.
2. For the recorded branch, verify that the installed version is no longer below 1.2.48.0. Do not assume that every other release branch is addressed unless Microsoft confirms that coverage.
3. Recheck inventory after deployment and record the installed version and update status for each endpoint.
4. Until updating is possible, reduce handling of untrusted HEIF content and limit user interaction with unverified content sources where operationally appropriate. This is a precautionary mitigation, not a confirmed software fix.

1. Inventory endpoints with Microsoft HEIF Image Extension installed and identify the installed version through software inventory or endpoint-management tooling.
2. Compare inventoried versions with the affected range in the record and verify the installation status of Microsoft's security update.
3. Prioritize review of endpoints where users may process untrusted HEIF content, but do not treat that condition as proof that a system is exploitable.
4. As a precaution, monitor for unusual process or code activity after users open or process image content. The record provides no specific IOC or log signature, and the absence of suspicious logs does not prove that a system is safe.