CVE-2025-62821 -- CVSS 9.1 Vulnerability Briefing

CVE-2025-62821 | CVSS 9.1 (Critical) | Exploit: No known exploit

What Is It

CVE-2025-62821 is an out-of-bounds read vulnerability in Microsoft HEIF Image Extensions version 1.2.22.0, specifically within the image parsing component responsible for handling HEIF item info entry data sizes.

Technical Detail

The flaw exists in the function CHEIFItemInfoEntry_GetDataSize, which can return a success status code while leaving the reported data size value at zero. A caller that trusts this return value then proceeds to perform a read operation using the zero-length size, resulting in an out-of-bounds memory read. Depending on what memory is accessed and how the result is consumed, this class of vulnerability can lead to information disclosure or, in more complex exploitation scenarios, contribute to memory corruption primitives; the CVSS score of 9.1 suggests the assessed impact is significant, likely involving reliable information disclosure or a path toward code execution through crafted HEIF image files.

Exploitation Status

No known exploit exists for this vulnerability at this time. It is not listed in the CISA Known Exploited Vulnerabilities catalog. There is no public proof-of-concept code confirmed as of this writing. The vulnerability should be treated as unweaponized but the technical primitive is well-understood and the attack surface, image file parsing, is historically attractive to threat actors.

Who Is Targeting This

No specific threat actor attribution at this time. Neither confirmed nor reported actor associations have been established for this CVE.

What To Do

Apply the latest available update to Microsoft HEIF Image Extensions through the Microsoft Store, as this component is distributed and updated via the Store rather than Windows Update. Administrators managing enterprise environments should verify that automatic Store updates are permitted for this extension or push the update through Microsoft Intune or equivalent management tooling. Organizations that do not require HEIF image support should consider removing the extension entirely as a risk reduction measure. Monitor endpoint detection telemetry for anomalous image file processing activity, particularly involving HEIF or HEIC files delivered via email or web download, as these represent the most likely delivery vectors for a future exploit targeting this vulnerability.