CVE-2026-62291

Received Received - Intake

Heap Corruption in libheif Image Decoding

Publication date: 2026-08-18

Last updated on: 2026-08-21

Assigner: GitHub, Inc.

Description

libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted image sequence with a 2x2 primary plane and a 256x256 auxiliary alpha plane can cause attacker-controlled heap corruption during a normal decode and re-encode workflow. Track_Visual::decode_next_image_sample() calls transfer_channel_from_image_as() without checking that the auxiliary alpha dimensions match the main frame. The resulting inconsistent image reaches heif_track_decode_next_image() and then heif_context_encode_image(). In unc_encoder::encode(), unc_encoder_component_interleave::encode_tile() sizes its buffer with compute_tile_data_size_bytes() using the primary dimensions but copies each component using its actual plane dimensions. The oversized alpha plane is therefore copied beyond the allocation, causing an out-of-bounds write; the inverse size mismatch can also produce an out-of-bounds read. This issue is fixed in version 1.23.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-21

Generated

2026-09-08

AI Q&A

2026-08-19

EPSS Evaluated

2026-09-07

NVD

CVE-2026-62291

Affected Vendors & Products

Vendor	Product	Version / Range
structural_heif	libheif	to 1.23.0 (inc)
structural_heif	libheif	to 1.23.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability in libheif versions 1.23.0 and earlier involves a crafted image sequence with mismatched dimensions between the primary plane (2x2) and auxiliary alpha plane (256x256). During decode and re-encode, an attacker can trigger heap corruption due to improper buffer handling. The issue occurs when copying alpha plane data beyond allocated memory, causing out-of-bounds writes or reads.

Detection Guidance

This vulnerability can be detected by checking the version of libheif installed on your system. If you are using libheif version 1.23.0 or earlier, your system is vulnerable. Run the command 'libheif-info --version' or 'dpkg -l | grep libheif' to check the installed version.

Impact Analysis

If exploited, this vulnerability could allow an attacker to execute arbitrary code, crash applications, or leak sensitive memory. It primarily affects systems processing HEIF/AVIF images with libheif, potentially leading to data breaches or denial-of-service conditions.

Compliance Impact

This vulnerability could compromise data integrity and confidentiality, violating GDPR's principles of data protection and HIPAA's safeguards for protected health information. Organizations processing affected image formats may face compliance violations if exploited.

Mitigation Strategies

Update libheif to version 1.23.1 or later to address the heap corruption issue in image sequence handling.

Hi! I’m here to help you understand CVE-2026-62291. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70