CVE-2026-120208
Deferred Deferred - Pending Action

Heap-based Buffer Overflow in libheif Image Decoder

Publication date: 2026-10-31

Last updated on: 2026-10-31

Assigner: VulnCheck

Description
libheif 1.18.0 before 1.23.3 contains a heap-based buffer overflow vulnerability in unc_decoder_mixed_interleave::processTile() that allows attackers to write out of bounds by supplying chroma components with unequal bit depths. Attackers can craft a HEIF file declaring, for example, 16-bit Cb and 8-bit Cr to trigger file-controlled heap writes past the Cr plane, potentially achieving code execution in image-processing pipelines.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-31
Last Modified
2026-10-31
Generated
2026-10-31
AI Q&A
2026-10-31
EPSS Evaluated
N/A
NVD
CVE-2026-120208
EUVD
EUVD-2026-114729

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
strukturag libheif 1.18.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-122 A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-120208 is a heap-based buffer overflow in libheif's uncompressed (unci) mixed-interleave decoder. It occurs when chroma components like Cb and Cr have unequal bit depths. The decoder allocates memory based on each plane's depth but incorrectly processes both using the first plane's dimensions, causing out-of-bounds writes. For example, a 16-bit Cb and 8-bit Cr can trigger heap corruption beyond the Cr plane.

Detection Guidance

To detect this vulnerability, check the installed version of libheif. If it is between 1.18.0 and 1.23.2, the system is vulnerable. Run: libheif-info --version or dpkg -l | grep libheif on Debian-based systems.

Impact Analysis

This vulnerability could allow attackers to execute arbitrary code in image-processing pipelines using libheif 1.18.0 to 1.23.2. Exploitation depends on specific conditions like library builds and runtime environments. For instance, a WordPress server with PHP Imagick and libheif 1.23.2 on Debian could be vulnerable to code execution.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by potentially allowing unauthorized code execution or data exfiltration in image-processing pipelines. If exploited, it may lead to unauthorized access to sensitive data, violating confidentiality requirements under these regulations. Organizations processing images with libheif versions 1.18.0 to 1.23.2 could face compliance risks if the vulnerability is leveraged to access or manipulate protected health information or personal data.

Mitigation Strategies

Upgrade libheif to version 1.23.3 or later immediately. This version patches the heap buffer overflow in the unc_decoder_mixed_interleave::processTile() function.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-120208. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart