CVE-2026-62292

Received Received - Intake

Heap Overflow in libheif Image Decoder

Publication date: 2026-08-18

Last updated on: 2026-08-25

Assigner: GitHub, Inc.

Description

libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.1, a crafted uncompressed HEIF image using generic zlib unci full-item compression can crash an application that decodes an advertised tile with heif_image_handle_decode_image_tile(). In libheif/codecs/uncompressed/unc_decoder.cc, unc_decoder::fetch_tile_data() computes a large tile offset and unc_decoder::get_compressed_image_data_uncompressed() validates it with range_start_offset plus range_size. For the last advertised tile (4095, 4095), the addition can wrap to zero, bypass the bounds check, and pass an invalid source pointer and a one-terabyte length to memcpy. The observed result is an out-of-bounds read and process crash; opening the file alone does not trigger the issue because tile decoding is required. This issue is fixed in version 1.23.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-25

Generated

2026-09-08

AI Q&A

2026-08-19

EPSS Evaluated

2026-09-06

NVD

CVE-2026-62292

Affected Vendors & Products

Vendor	Product	Version / Range
structural_heif	libheif	From 1.19.0 (inc) to 1.23.1 (inc)
structural_heif	libheif	1.23.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability in libheif affects versions 1.19.0 to 1.23.1. It involves a crafted uncompressed HEIF image that can crash an application when decoding a specific tile. The issue occurs due to incorrect offset calculations in the zlib decompression process, leading to an out-of-bounds read and process termination.

Detection Guidance

Detecting this vulnerability requires checking the installed version of libheif. Use commands like 'heif-info --version' or 'dpkg -l | grep libheif' on Linux to verify if the version is below 1.23.1. If the version is 1.19.0 to 1.23.0, the system is vulnerable.

Impact Analysis

If you process HEIF or AVIF images using affected libheif versions, an attacker could exploit this flaw to crash your application by providing a maliciously crafted file. This could lead to denial-of-service conditions or potential further exploitation depending on the application context.

Compliance Impact

This vulnerability causes an out-of-bounds read and process crash when decoding specific HEIF images, which could lead to denial of service or application instability. It does not directly impact data confidentiality or integrity but may disrupt systems handling sensitive data, potentially affecting compliance with standards requiring availability and stability of processing systems.

Mitigation Strategies

Upgrade libheif to version 1.23.1 or later immediately. On Linux, use package managers like 'apt' or 'yum' to update. For example, run 'sudo apt update && sudo apt upgrade libheif' or 'sudo yum update libheif'.

Hi! I’m here to help you understand CVE-2026-62292. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70