{"id":"CVE-2026-120208","aliases":["DEBIAN-CVE-2026-120208","EUVD-2026-114729","GHSA-wqmc-6h9q-v6wp","GHSA-x8r2-mggj-j6wr","ROOT-OS-DEBIAN-12-CVE-2026-120208","UBUNTU-CVE-2026-120208","USN-9012-1"],"status":"published","title":"libheif 1.18.0 before 1.23.3 Heap Buffer Overflow via unci Mixed-Interleave Decoder","description":"libheif 1.18.0 before 1.23.3 contains a heap-based buffer overflow vulnerability in unc_decoder_mixed_interleave::processTile() that allows attackers to write out of bounds by supplying chroma components with unequal bit depths. Attackers can craft a HEIF file declaring, for example, 16-bit Cb and 8-bit Cr to trigger file-controlled heap writes past the Cr plane, potentially achieving code execution in image-processing pipelines.","severity":{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00365,"percentile":0.30754,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-122"],"published":"2026-10-31T17:25:55Z","modified":"2026-11-11T09:39:21Z","fixes":[{"ecosystem":"Debian:13","package":"libheif","fixed_in":["1.23.4-1~deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libheif","fixed_in":["1.23.3-1"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"libheif","fixed_in":["1.15.1-1+deb12u1.aikido.17"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-libheif","fixed_in":["1.15.1-1+deb12u1.aikido.17"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"libheif","fixed_in":["1.21.2-3ubuntu0.7"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.15.1-1","1.15.1-1+deb12u1","1.16.2-1","1.16.2-2","1.16.2-3","1.17.0-1","1.17.1-1","1.17.4-1","1.17.6-1","1.17.6-2","1.17.6-3","1.17.6-4","1.18.1-1","1.18.1-2","1.18.2-1","1.18.2-2","1.19.1-1","1.19.1-1~bpo12+1","1.19.1-1~bpo12+2","1.19.3-1","1.19.3-1~bpo12+1","1.19.5-1","1.19.7-1","1.19.7-1~bpo12+1","1.19.8-1","1.20.1-1","1.20.2-1","1.20.2-2","1.21.2-1","1.21.2-2","1.21.2-3","1.21.2-4","1.23.1-1","1.23.2-1","1.23.3-1","1.23.4-1","1.23.4-1~deb13u1","1.23.6-1","1.23.6-2","1.23.6-2~deb13u1"]},{"source":"osv","ecosystem":"Debian:13","package":"libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.4-1~deb13u1"}]}],"versions":["1.19.8-1","1.19.8-1+deb13u1","1.20.1-1","1.20.2-1","1.20.2-2","1.21.2-1","1.21.2-2","1.21.2-3","1.21.2-4","1.23.1-1","1.23.2-1","1.23.3-1"]},{"source":"osv","ecosystem":"Debian:14","package":"libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.3-1"}]}],"versions":["1.19.8-1","1.20.1-1","1.20.2-1","1.20.2-2","1.21.2-1","1.21.2-2","1.21.2-3","1.21.2-4","1.23.1-1","1.23.2-1"]},{"source":"osv","ecosystem":"Root:Debian:12","package":"libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.1-1+deb12u1.aikido.17"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.1-1+deb12u1.aikido.17"}]}]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.2-3ubuntu0.7"}]}],"versions":["1.20.2-1","1.20.2-2","1.20.2-2build1","1.20.2-2build2","1.20.2-2ubuntu1","1.21.2-1","1.21.2-3","1.21.2-3ubuntu0.1","1.21.2-3ubuntu0.2","1.21.2-3ubuntu0.3","1.21.2-3ubuntu0.4","1.21.2-3ubuntu0.5","1.21.2-3ubuntu0.6"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.2-3ubuntu0.7"}]}],"versions":["1.20.2-1","1.20.2-2","1.20.2-2build1","1.20.2-2build2","1.20.2-2ubuntu1","1.21.2-1","1.21.2-3","1.21.2-3ubuntu0.1","1.21.2-3ubuntu0.2","1.21.2-3ubuntu0.3","1.21.2-3ubuntu0.4","1.21.2-3ubuntu0.5","1.21.2-3ubuntu0.6"]}],"products":[{"vendor":"strukturag","product":"libheif"}],"references":[{"url":"https://github.com/strukturag/libheif/security/advisories/GHSA-x8r2-mggj-j6wr","tags":["vendor-advisory","advisory","report"]},{"url":"https://github.com/strukturag/libheif/commit/9d3cd91d7b1c8c68deef6d06057ab956bcb0dfb9","tags":["patch","fix","report"]},{"url":"https://github.com/strukturag/libheif/releases/tag/v1.23.3","tags":["release-notes","advisory","report"]},{"url":"https://github.com/strukturag/libheif/blob/v1.23.2/libheif/codecs/uncompressed/unc_decoder_mixed_interleave.cc#L95","tags":["technical-description","article","report"]},{"url":"https://www.vulncheck.com/advisories/libheif-1.18.0-before-1.23.3-heap-buffer-overflow-via-unci-mixed-interleave-decoder","tags":["third-party-advisory","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120208","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-wqmc-6h9q-v6wp"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/120xxx/CVE-2026-120208.json","tags":["advisory"]},{"url":"https://github.com/strukturag/libheif","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-120208","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-120208","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-120208","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-9012-1","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-120208","title":"libheif 1.18.0 before 1.23.3 Heap Buffer Overflow via unci Mixed-Interleave Decoder","description":"libheif 1.18.0 before 1.23.3 contains a heap-based buffer overflow vulnerability in unc_decoder_mixed_interleave::processTile() that allows attackers to write out of bounds by supplying chroma components with unequal bit depths. Attackers can craft a HEIF file declaring, for example, 16-bit Cb and 8-bit Cr to trigger file-controlled heap writes past the Cr plane, potentially achieving code execution in image-processing pipelines.","status":"published","published":"2026-10-31T17:25:55.507Z","modified":"2026-11-02T17:45:27.671Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T19:02:29.283836Z"}],"euvd":[{"id":"EUVD-2026-114729","description":"libheif 1.18.0 before 1.23.3 contains a heap-based buffer overflow vulnerability in unc_decoder_mixed_interleave::processTile() that allows attackers to write out of bounds by supplying chroma components with unequal bit depths. Attackers can craft a HEIF file declaring, for example, 16-bit Cb and 8-bit Cr to trigger file-controlled heap writes past the Cr plane, potentially achieving code execution in image-processing pipelines.","status":"published","published":"2026-10-31T17:25:55Z","modified":"2026-11-02T17:45:27Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-03T05:08:39.228431Z"}],"ghsa":[{"id":"GHSA-wqmc-6h9q-v6wp","title":"libheif 1.18.0 before 1.23.3 contains a heap-based buffer overflow vulnerability in...","description":"libheif 1.18.0 before 1.23.3 contains a heap-based buffer overflow vulnerability in unc_decoder_mixed_interleave::processTile() that allows attackers to write out of bounds by supplying chroma components with unequal bit depths. Attackers can craft a HEIF file declaring, for example, 16-bit Cb and 8-bit Cr to trigger file-controlled heap writes past the Cr plane, potentially achieving code execution in image-processing pipelines.","status":"published","published":"2026-10-31T18:30:23Z","modified":"2026-10-31T18:30:30Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T15:14:54.535223Z"}],"nvd":[{"id":"CVE-2026-120208","description":"libheif 1.18.0 before 1.23.3 contains a heap-based buffer overflow vulnerability in unc_decoder_mixed_interleave::processTile() that allows attackers to write out of bounds by supplying chroma components with unequal bit depths. Attackers can craft a HEIF file declaring, for example, 16-bit Cb and 8-bit Cr to trigger file-controlled heap writes past the Cr plane, potentially achieving code execution in image-processing pipelines.","status":"published","published":"2026-10-31T18:17:09.083Z","modified":"2026-11-02T18:18:47.01Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T20:51:44.219211Z"}],"osv":[{"id":"CVE-2026-120208","title":"libheif 1.18.0 before 1.23.3 Heap Buffer Overflow via unci Mixed-Interleave Decoder","description":"libheif 1.18.0 before 1.23.3 contains a heap-based buffer overflow vulnerability in unc_decoder_mixed_interleave::processTile() that allows attackers to write out of bounds by supplying chroma components with unequal bit depths. Attackers can craft a HEIF file declaring, for example, 16-bit Cb and 8-bit Cr to trigger file-controlled heap writes past the Cr plane, potentially achieving code execution in image-processing pipelines.","status":"published","published":"2026-10-31T17:25:55.507Z","modified":"2026-11-04T07:08:04.733541222Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-122"],"updated_at":"2026-11-04T07:32:23.735279Z"},{"id":"DEBIAN-CVE-2026-120208","description":"libheif 1.18.0 before 1.23.3 contains a heap-based buffer overflow vulnerability in unc_decoder_mixed_interleave::processTile() that allows attackers to write out of bounds by supplying chroma components with unequal bit depths. Attackers can craft a HEIF file declaring, for example, 16-bit Cb and 8-bit Cr to trigger file-controlled heap writes past the Cr plane, potentially achieving code execution in image-processing pipelines.","status":"published","published":"2026-10-31T18:17:09.083Z","modified":"2026-11-03T10:00:24.850797901Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-03T10:27:58.933618Z"},{"id":"UBUNTU-CVE-2026-120208","description":"libheif 1.18.0 before 1.23.3 contains a heap-based buffer overflow vulnerability in unc_decoder_mixed_interleave::processTile() that allows attackers to write out of bounds by supplying chroma components with unequal bit depths. Attackers can craft a HEIF file declaring, for example, 16-bit Cb and 8-bit Cr to trigger file-controlled heap writes past the Cr plane, potentially achieving code execution in image-processing pipelines.","status":"published","published":"2026-10-31T18:17:00Z","modified":"2026-11-11T09:39:21.072260964Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-11T10:01:18.620522Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2026-120208","title":"CVE-2026-120208 in libheif - Patched by Root","description":"Root has patched CVE-2026-120208 in the libheif package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-11-03T12:12:10Z","modified":"2026-11-03T13:15:05.569033778Z","updated_at":"2026-11-03T13:33:04.521148Z"},{"id":"USN-9012-1","title":"libheif vulnerability","description":"Alex Thomas discovered that libheif incorrectly handled certain HEIF\nimages. An attacker could possibly use this issue to execute arbitrary code\nif a user or automated system were tricked into opening a specially crafted\nfile.","status":"published","published":"2026-11-09T16:44:41Z","modified":"2026-11-11T09:44:38.472864745Z","updated_at":"2026-11-12T18:08:43.376257Z"}]}}