allocate_planes_with_default_values iterates the planes of a Category, computes plane_size = width * height for each (src/image.rs:388), and is supposed to (re)allocate an owned buffer sized to the current dimensions. Pre-fix, src/image.rs:389-395 short-circuited this with if self.planes[plane_index].is_some() && self.planes[plane_index].unwrap_ref().size() == plane_size && (pixel_bit_size()==0 || pixel_bit_size()==pixel_size*8) { continue; }, skipping the allocation whenever a plane already held a buffer whose element count matched. When that continue fired, the body at src/image.rs:401-404 — pixels.resize(plane_size, ...) (src/utils/pixels.rs:82), the self.row_bytes[plane_index] update, and self.image_owns_planes[plane_index] = true — never ran. Because the skip condition at src/image.rs:390 requires size() == plane_size, the retained buffer’s element count already equals a fresh allocation; what is left stale is the plane’s row_bytes stride (:403), its default-value fill (:402), and its image_owns_planes flag (:404), none of which are refreshed for the current geometry. As the commit message states, this “may inadvertently not allocate the memory in some cases (e.g. alpha plane when the color planes have already been allocated).” A subsequent writer that fills/scales the plane using the stale row_bytes stride then writes past the buffer, matching the advisory’s heap-buffer-overflow WRITE in Codecs (inferred — the libyuv scaler that performs this write is not in the shown material).

The fix deletes the entire conditional skip (diff removes src/image.rs:389-395) so the buffer is always freshly allocated via resize and row_bytes is always reset, and removes the now-unused pixel_bit_size helper (src/utils/pixels.rs:64-71).

An attacker who gets the renderer to decode a malicious AVIF can cause a heap buffer overflow write during plane handling in the codec path, corrupting adjacent renderer-process heap memory. The advisory rates this high severity and reports no in-the-wild exploitation; escalation beyond the overflow write is (inferred).