CVE-2026-62289

Received Received - Intake

Heap Overflow in libheif Image Processing

Publication date: 2026-08-18

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description

libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF or AVIF file containing a clean aperture box can reduce an image dimension to zero and crash or corrupt tiling results when heif_image_handle_get_image_tiling(handle, 1, &tiling) is called. ImageItem::get_heif_image_tiling() returns already transformed dimensions, and process_image_transformations_on_tiling() applies the clean aperture transformation again. The second application passes zero to Box_clap::left_rounded(0), where image_width minus one underflows and constructs Fraction(0xFFFFFFFF, 2). Debug builds reach an assertion and abort, while release builds can return a corrupt crop and zero-width tiling result. The affected implementation spans libheif/image-items/image_item.cc, libheif/context.cc, and libheif/box.cc. This issue is fixed in version 1.23.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-19

Generated

2026-09-08

AI Q&A

2026-08-19

EPSS Evaluated

2026-09-06

NVD

CVE-2026-62289

Affected Vendors & Products

Vendor	Product	Version / Range
structural_heif	libheif	to 1.23.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-191	The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.
CWE-617	The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

Attack-Flow Graph

Executive Summary

This vulnerability in libheif versions 1.23.0 and earlier involves a crafted HEIF or AVIF file that contains a clean aperture box. When processed, it reduces an image dimension to zero, causing crashes or corruption in tiling results. The issue stems from a double application of the clean aperture transformation, leading to an underflow and corrupt output.

Detection Guidance

Detecting this vulnerability requires checking the version of libheif installed on your system. Use the command 'heif-info --version' or 'dpkg -l | grep libheif' on Debian-based systems to verify if the installed version is 1.23.0 or earlier. If so, the system is vulnerable.

Impact Analysis

This vulnerability could allow attackers to crash applications or corrupt image processing results by providing maliciously crafted HEIF or AVIF files. Users may experience application failures or unexpected behavior when opening such files.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a technical flaw in image processing that may cause crashes or corruption. However, if exploited, it could lead to denial-of-service conditions or data integrity issues in systems handling HEIF/AVIF files, potentially impacting availability or integrity requirements under such regulations.

Mitigation Strategies

Upgrade libheif to version 1.23.1 or later immediately. On Debian-based systems, use 'sudo apt-get update && sudo apt-get install --only-upgrade libheif1'. For other distributions, check the official package manager or compile from source using the latest release from the libheif GitHub repository.

Hi! I’m here to help you understand CVE-2026-62289. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70