Every CVE Search/ Get API key

CVE-2026-62292

libheif: Out-of-bounds read in uncompressed unci tile range slicing

8.7 HighFix available

libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.1, a crafted uncompressed HEIF image using generic zlib unci full-item compression can crash an application that decodes an advertised tile with heif_image_handle_decode_image_tile(). In libheif/codecs/uncompressed/unc_decoder.cc, unc_decoder::fetch_tile_data() computes a large tile offset and unc_decoder::get_compressed_image_data_uncompressed() validates it with range_start_offset plus range_size. For the last advertised tile (4095, 4095), the addition can wrap to zero, bypass the bounds check, and pass an invalid source pointer and a one-terabyte length to memcpy. The observed result is an out-of-bounds read and process crash; opening the file alone does not trigger the issue because tile decoding is required. This issue is fixed in version 1.23.1.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.56%Unchanged since Aug 19, 2026
90%50%10%1%

What each source reports

CVE List Score used 8.7

libheif: Out-of-bounds read in uncompressed unci tile range slicing

libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.1, a crafted uncompressed HEIF image using generic zlib unci full-item compression can crash an application that decodes an advertised tile with heif_image_handle_decode_image_tile(). In libheif/codecs/uncompressed/unc_decoder.cc, unc_decoder::fetch_tile_data() computes a large tile offset and unc_decoder::get_compressed_image_data_uncompressed() validates it with range_start_offset plus range_size. For the last advertised tile (4095, 4095), the addition can wrap to zero, bypass the bounds check, and pass an invalid source pointer and a one-terabyte length to memcpy. The observed result is an out-of-bounds read and process crash; opening the file alone does not trigger the issue because tile decoding is required. This issue is fixed in version 1.23.1.

Record
CVE-2026-62292
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-125
Updated
2026-11-02
EUVDEUVD-2026-62189 8.7

libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.1, a crafted uncompressed HEIF image using generic zlib unci full-item compression can crash an application that decodes an advertised tile with heif_image_handle_decode_image_tile(). In libheif/codecs/uncompressed/unc_decoder.cc, unc_decoder::fetch_tile_data() computes a large tile offset and unc_decoder::get_compressed_image_data_uncompressed() validates it with range_start_offset plus range_size. For the last advertised tile (4095, 4095), the addition can wrap to zero, bypass the bounds check, and pass an invalid source pointer and a one-terabyte length to memcpy. The observed result is an out-of-bounds read and process crash; opening the file alone does not trigger the issue because tile decoding is required. This issue is fixed in version 1.23.1.

Record
EUVD-2026-62189
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
NVD 8.7

libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.1, a crafted uncompressed HEIF image using generic zlib unci full-item compression can crash an application that decodes an advertised tile with heif_image_handle_decode_image_tile(). In libheif/codecs/uncompressed/unc_decoder.cc, unc_decoder::fetch_tile_data() computes a large tile offset and unc_decoder::get_compressed_image_data_uncompressed() validates it with range_start_offset plus range_size. For the last advertised tile (4095, 4095), the addition can wrap to zero, bypass the bounds check, and pass an invalid source pointer and a one-terabyte length to memcpy. The observed result is an out-of-bounds read and process crash; opening the file alone does not trigger the issue because tile decoding is required. This issue is fixed in version 1.23.1.

Record
CVE-2026-62292
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness
CWE-125
Updated
2026-11-02
OSV 8.7

libheif: Out-of-bounds read in uncompressed unci tile range slicing

libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.1, a crafted uncompressed HEIF image using generic zlib unci full-item compression can crash an application that decodes an advertised tile with heif_image_handle_decode_image_tile(). In libheif/codecs/uncompressed/unc_decoder.cc, unc_decoder::fetch_tile_data() computes a large tile offset and unc_decoder::get_compressed_image_data_uncompressed() validates it with range_start_offset plus range_size. For the last advertised tile (4095, 4095), the addition can wrap to zero, bypass the bounds check, and pass an invalid source pointer and a one-terabyte length to memcpy. The observed result is an out-of-bounds read and process crash; opening the file alone does not trigger the issue because tile decoding is required. This issue is fixed in version 1.23.1.

Record
CVE-2026-62292
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-125
Updated
2026-11-02
OSVDEBIAN-CVE-2026-62292 8.7

libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.1, a crafted uncompressed HEIF image using generic zlib unci full-item compression can crash an application that decodes an advertised tile with heif_image_handle_decode_image_tile(). In libheif/codecs/uncompressed/unc_decoder.cc, unc_decoder::fetch_tile_data() computes a large tile offset and unc_decoder::get_compressed_image_data_uncompressed() validates it with range_start_offset plus range_size. For the last advertised tile (4095, 4095), the addition can wrap to zero, bypass the bounds check, and pass an invalid source pointer and a one-terabyte length to memcpy. The observed result is an out-of-bounds read and process crash; opening the file alone does not trigger the issue because tile decoding is required. This issue is fixed in version 1.23.1.

Record
DEBIAN-CVE-2026-62292
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVUBUNTU-CVE-2026-62292 8.7

libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.1, a crafted uncompressed HEIF image using generic zlib unci full-item compression can crash an application that decodes an advertised tile with heif_image_handle_decode_image_tile(). In libheif/codecs/uncompressed/unc_decoder.cc, unc_decoder::fetch_tile_data() computes a large tile offset and unc_decoder::get_compressed_image_data_uncompressed() validates it with range_start_offset plus range_size. For the last advertised tile (4095, 4095), the addition can wrap to zero, bypass the bounds check, and pass an invalid source pointer and a one-terabyte length to memcpy. The observed result is an out-of-bounds read and process crash; opening the file alone does not trigger the issue because tile decoding is required. This issue is fixed in version 1.23.1.

Record
UBUNTU-CVE-2026-62292
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
Show 6 moreShow less
OSVopenSUSE-SU-2026:11416-1 No score

gdk-pixbuf-loader-libheif-1.23.1-1.1 on GA media

These are all security issues fixed in the gdk-pixbuf-loader-libheif-1.23.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11416-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21644-1 No score

Security update for libheif

This update for libheif fixes the following issues:

Update to version 1.23.1 (jsc#PED-16355).

Security issues fixed:

  • CVE-2026-62289: integer underflow in Fraction constructor via double clap transform application (bsc#1273079).
  • CVE-2026-62291: heap out-of-bounds write in the uncompressed encoder when writing images with mismatched auxiliary alpha dimensions (bsc#1273080).
  • CVE-2026-62292: out-of-bounds read in uncompressed unci tile range slicing (bsc#1273081).
  • CVE-2026-62377: reachable assertion in HeifContext::get_track() aborts on a valid-but-empty HEIF sequence file (bsc#1273082).
  • Heap out-of-bounds write in the uncompressed encoder for RRGGBB images with interleaved bit-depth <= 8 (bsc#1273083).

Changes for libheif:

  • Version 1.23.1
    • FFmpeg decoder plugin gains AV1, VVC, JPEG, and JPEG 2000/HTJ2K decoding.
    • SVT-AV1 encoder: new tune=iq and ms-ssim tune parameters.
    • C++ API: added getters/setters for the CLLI and MDCV HDR metadata boxes.
    • Sequence decoder now scales the alpha auxiliary track to the main image size.
    • Fixed pixi box writing for multi-channel images.
    • Corrected the placement of the TAI clock_type field into the top 2 bits.
    • Empty/unset plugin directory is no longer scanned.
Record
openSUSE-SU-2026:21644-1
Updated
2026-11-02
OSVROOT-OS-DEBIAN-11-CVE-2026-62292 No score

CVE-2026-62292 in libheif - Patched by Root

Root has patched CVE-2026-62292 in the libheif package for Root:Debian:11. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-11-CVE-2026-62292
Updated
2026-11-02
OSVROOT-OS-DEBIAN-12-CVE-2026-62292 No score

CVE-2026-62292 in libheif - Patched by Root

Root has patched CVE-2026-62292 in the libheif package for Root:Debian:12. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-12-CVE-2026-62292
Updated
2026-11-03
OSVSUSE-SU-2026:23320-1 No score

Security update for libheif

This update for libheif fixes the following issues:

Update to version 1.23.1 (jsc#PED-16355).

Security issues fixed:

  • CVE-2026-62289: integer underflow in Fraction constructor via double clap transform application (bsc#1273079).
  • CVE-2026-62291: heap out-of-bounds write in the uncompressed encoder when writing images with mismatched auxiliary alpha dimensions (bsc#1273080).
  • CVE-2026-62292: out-of-bounds read in uncompressed unci tile range slicing (bsc#1273081).
  • CVE-2026-62377: reachable assertion in HeifContext::get_track() aborts on a valid-but-empty HEIF sequence file (bsc#1273082).
  • Heap out-of-bounds write in the uncompressed encoder for RRGGBB images with interleaved bit-depth <= 8 (bsc#1273083).

Changes for libheif:

  • Version 1.23.1
    • FFmpeg decoder plugin gains AV1, VVC, JPEG, and JPEG 2000/HTJ2K decoding.
    • SVT-AV1 encoder: new tune=iq and ms-ssim tune parameters.
    • C++ API: added getters/setters for the CLLI and MDCV HDR metadata boxes.
    • Sequence decoder now scales the alpha auxiliary track to the main image size.
    • Fixed pixi box writing for multi-channel images.
    • Corrected the placement of the TAI clock_type field into the top 2 bits.
    • Empty/unset plugin directory is no longer scanned.
Record
SUSE-SU-2026:23320-1
Updated
2026-11-02
OSVSUSE-SU-2026:3597-1 No score

Security update for libheif

This update for libheif fixes the following issues:

Update to version 1.23.1 (jsc#PED-16355).

Security issues fixed:

  • CVE-2026-62289: integer underflow in Fraction constructor via double clap transform application (bsc#1273079).
  • CVE-2026-62291: heap out-of-bounds write in the uncompressed encoder when writing images with mismatched auxiliary alpha dimensions (bsc#1273080).
  • CVE-2026-62292: out-of-bounds read in uncompressed unci tile range slicing (bsc#1273081).
  • CVE-2026-62377: reachable assertion in HeifContext::get_track() aborts on a valid-but-empty HEIF sequence file (bsc#1273082).
  • Heap out-of-bounds write in the uncompressed encoder for RRGGBB images with interleaved bit-depth <= 8 (bsc#1273083).

Changes for libheif:

  • Version 1.23.1
    • FFmpeg decoder plugin gains AV1, VVC, JPEG, and JPEG 2000/HTJ2K decoding.
    • SVT-AV1 encoder: new tune=iq and ms-ssim tune parameters.
    • C++ API: added getters/setters for the CLLI and MDCV HDR metadata boxes.
    • Sequence decoder now scales the alpha auxiliary track to the main image size.
    • Fixed pixi box writing for multi-channel images.
    • Corrected the placement of the TAI clock_type field into the top 2 bits.
    • Empty/unset plugin directory is no longer scanned.
Record
SUSE-SU-2026:3597-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
libheif
Alpaquita:stream
 1.20.2-r2 up to 1.23.4-r0
1.23.4-r0
libheif
Debian:12
 All versions, plus listed versions
1.15.1-11.15.1-1+deb12u11.16.2-11.16.2-21.16.2-3
Show 34 moreShow less
1.17.0-11.17.1-11.17.4-11.17.6-11.17.6-21.17.6-31.17.6-41.18.1-11.18.1-21.18.2-11.18.2-21.19.1-11.19.1-1~bpo12+11.19.1-1~bpo12+21.19.3-11.19.3-1~bpo12+11.19.5-11.19.7-11.19.7-1~bpo12+11.19.8-11.20.1-11.20.2-11.20.2-21.21.2-11.21.2-21.21.2-31.21.2-41.23.1-11.23.2-11.23.3-11.23.4-11.23.4-1~deb13u11.23.6-11.23.6-2
 None known
libheif
Debian:13
 before 1.19.8-1+deb13u1, plus listed versions
1.19.8-1
1.19.8-1+deb13u1
libheif
Debian:14
 before 1.23.1-1, plus listed versions
1.19.8-11.20.1-11.20.2-11.20.2-21.21.2-11.21.2-21.21.2-31.21.2-4
1.23.1-1
libheif
Root:Debian:11
 before 1.11.0-1+deb11u2.aikido.6
1.11.0-1+deb11u2.aikido.6
rootio-libheif
Root:Debian:11
 before 1.11.0-1+deb11u2.aikido.6
1.11.0-1+deb11u2.aikido.6
libheif
Root:Debian:12
 before 1.15.1-1+deb12u1.aikido.13
1.15.1-1+deb12u1.aikido.131.15.1-1+deb12u1.aikido.141.15.1-1+deb12u1.aikido.151.15.1-1+deb12u1.aikido.161.15.1-1+deb12u1.aikido.17
rootio-libheif
Root:Debian:12
 before 1.15.1-1+deb12u1.aikido.13
1.15.1-1+deb12u1.aikido.131.15.1-1+deb12u1.aikido.141.15.1-1+deb12u1.aikido.151.15.1-1+deb12u1.aikido.161.15.1-1+deb12u1.aikido.17
libheif
SUSE:Linux Enterprise Server 16.0
From an advisory covering 4 CVEs
 before 1.23.1-160000.1.1
1.23.1-160000.1.1
libheif
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 4 CVEs
 before 1.23.1-160000.1.1
1.23.1-160000.1.1
Show 5 moreShow less
Affected packages
PackageAffectedFixed
libheif
SUSE:Linux Enterprise Module for Desktop Applications 15 SP7
From an advisory covering 4 CVEs
 before 1.23.1-150700.3.18.1
1.23.1-150700.3.18.1
libheif
SUSE:Linux Enterprise Module for Package Hub 15 SP7
From an advisory covering 4 CVEs
 before 1.23.1-150700.3.18.1
1.23.1-150700.3.18.1
libheif
Ubuntu:26.04:LTS
 before 1.21.2-3ubuntu0.4, plus listed versions
1.20.2-11.20.2-21.20.2-2build11.20.2-2build21.20.2-2ubuntu1
Show 5 moreShow less
1.21.2-11.21.2-31.21.2-3ubuntu0.11.21.2-3ubuntu0.21.21.2-3ubuntu0.3
1.21.2-3ubuntu0.4
libheif
openSUSE:Tumbleweed
From an advisory covering 4 CVEs
 before 1.23.1-1.1
1.23.1-1.1
libheif
openSUSE:Leap 16.0
From an advisory covering 4 CVEs
 before 1.23.1-160000.1.1
1.23.1-160000.1.1

History

History
RecordedChangedSources
affected, facts
affectedOSV
first indexedCVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-62292 is a high vulnerability (CVSS 8.7) in Strukturag Libheif, published August 1, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.56%, the 46th percentile. Fixed in libheif 1.23.4-r0.

References

Show 15 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open