{"id":"CVE-2026-62289","aliases":["BELL-CVE-2026-62289","DEBIAN-CVE-2026-62289","EUVD-2026-62188","GHSA-jc8f-p23p-5hjg","SUSE-SU-2026:23320-1","SUSE-SU-2026:3597-1","UBUNTU-CVE-2026-62289","USN-8649-1","USN-8683-1","openSUSE-SU-2026:11416-1","openSUSE-SU-2026:21644-1"],"status":"published","title":"libheif: Integer underflow in Fraction constructor via double clap transform application","description":"libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF or AVIF file containing a clean aperture box can reduce an image dimension to zero and crash or corrupt tiling results when heif_image_handle_get_image_tiling(handle, 1, \u0026tiling) is called. ImageItem::get_heif_image_tiling() returns already transformed dimensions, and process_image_transformations_on_tiling() applies the clean aperture transformation again. The second application passes zero to Box_clap::left_rounded(0), where image_width minus one underflows and constructs Fraction(0xFFFFFFFF, 2). Debug builds reach an assertion and abort, while release builds can return a corrupt crop and zero-width tiling result. The affected implementation spans libheif/image-items/image_item.cc, libheif/context.cc, and libheif/box.cc. This issue is fixed in version 1.23.1.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00302,"percentile":0.23241,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-191","CWE-617"],"published":"2026-08-01T00:00:00Z","modified":"2026-10-28T10:55:03Z","fixes":[{"ecosystem":"Alpaquita:stream","package":"libheif","fixed_in":["1.23.4-r0"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libheif","fixed_in":["1.19.8-1+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libheif","fixed_in":["1.23.1-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libheif","fixed_in":["1.1.0-2ubuntu0.1~esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libheif","fixed_in":["1.6.1-1ubuntu0.1~esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"libheif","fixed_in":["1.12.0-2ubuntu0.1~esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"libheif","fixed_in":["1.17.6-1ubuntu4.7"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"libheif","fixed_in":["1.21.2-3ubuntu0.4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpaquita:stream","package":"libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.20.2-r2"},{"fixed":"1.23.4-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.15.1-1","1.15.1-1+deb12u1","1.16.2-1","1.16.2-2","1.16.2-3","1.17.0-1","1.17.1-1","1.17.4-1","1.17.6-1","1.17.6-2","1.17.6-3","1.17.6-4","1.18.1-1","1.18.1-2","1.18.2-1","1.18.2-2","1.19.1-1","1.19.1-1~bpo12+1","1.19.1-1~bpo12+2","1.19.3-1","1.19.3-1~bpo12+1","1.19.5-1","1.19.7-1","1.19.7-1~bpo12+1","1.19.8-1","1.20.1-1","1.20.2-1","1.20.2-2","1.21.2-1","1.21.2-2","1.21.2-3","1.21.2-4","1.23.1-1","1.23.2-1","1.23.3-1","1.23.4-1","1.23.4-1~deb13u1","1.23.6-1","1.23.6-2"]},{"source":"osv","ecosystem":"Debian:13","package":"libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.8-1+deb13u1"}]}],"versions":["1.19.8-1"]},{"source":"osv","ecosystem":"Debian:14","package":"libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.1-1"}]}],"versions":["1.19.8-1","1.20.1-1","1.20.2-1","1.20.2-2","1.21.2-1","1.21.2-2","1.21.2-3","1.21.2-4"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.1-160000.1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.1-160000.1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP7","package":"libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.1-150700.3.18.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.1-150700.3.18.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-2ubuntu0.1~esm4"}]}],"versions":["1.1.0-2","1.1.0-2ubuntu0.1~esm1","1.1.0-2ubuntu0.1~esm2","1.1.0-2ubuntu0.1~esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-1ubuntu0.1~esm4"}]}],"versions":["1.5.0-1build1","1.5.1-1","1.5.1-1build1","1.6.0-1","1.6.1-1","1.6.1-1build1","1.6.1-1ubuntu0.1~esm1","1.6.1-1ubuntu0.1~esm2","1.6.1-1ubuntu0.1~esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.0-2ubuntu0.1~esm4"}]}],"versions":["1.11.0-1","1.12.0-2build1","1.12.0-2ubuntu0.1~esm1","1.12.0-2ubuntu0.1~esm2","1.12.0-2ubuntu0.1~esm3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.6-1ubuntu4.7"}]}],"versions":["1.16.2-2ubuntu1","1.17.1-1ubuntu2","1.17.1-1ubuntu3","1.17.4-1ubuntu1","1.17.6-1ubuntu1","1.17.6-1ubuntu2","1.17.6-1ubuntu3","1.17.6-1ubuntu4","1.17.6-1ubuntu4.1","1.17.6-1ubuntu4.2","1.17.6-1ubuntu4.3","1.17.6-1ubuntu4.4","1.17.6-1ubuntu4.5","1.17.6-1ubuntu4.6"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.2-3ubuntu0.4"}]}],"versions":["1.20.2-1","1.20.2-2","1.20.2-2build1","1.20.2-2build2","1.20.2-2ubuntu1","1.21.2-1","1.21.2-3","1.21.2-3ubuntu0.1","1.21.2-3ubuntu0.2","1.21.2-3ubuntu0.3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.6-1ubuntu4.7"}]}],"versions":["1.16.2-2ubuntu1","1.17.1-1ubuntu2","1.17.1-1ubuntu3","1.17.4-1ubuntu1","1.17.6-1ubuntu1","1.17.6-1ubuntu2","1.17.6-1ubuntu3","1.17.6-1ubuntu4","1.17.6-1ubuntu4.1","1.17.6-1ubuntu4.2","1.17.6-1ubuntu4.3","1.17.6-1ubuntu4.4","1.17.6-1ubuntu4.5","1.17.6-1ubuntu4.6"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.2-3ubuntu0.4"}]}],"versions":["1.20.2-1","1.20.2-2","1.20.2-2build1","1.20.2-2build2","1.20.2-2ubuntu1","1.21.2-1","1.21.2-3","1.21.2-3ubuntu0.1","1.21.2-3ubuntu0.2","1.21.2-3ubuntu0.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-2ubuntu0.1~esm4"}]}],"versions":["1.1.0-2","1.1.0-2ubuntu0.1~esm1","1.1.0-2ubuntu0.1~esm2","1.1.0-2ubuntu0.1~esm3"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-1ubuntu0.1~esm4"}]}],"versions":["1.5.0-1build1","1.5.1-1","1.5.1-1build1","1.6.0-1","1.6.1-1","1.6.1-1build1","1.6.1-1ubuntu0.1~esm1","1.6.1-1ubuntu0.1~esm2","1.6.1-1ubuntu0.1~esm3"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.0-2ubuntu0.1~esm4"}]}],"versions":["1.11.0-1","1.12.0-2build1","1.12.0-2ubuntu0.1~esm1","1.12.0-2ubuntu0.1~esm2","1.12.0-2ubuntu0.1~esm3"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.6-1ubuntu4.8"}]}],"versions":["1.16.2-2ubuntu1","1.17.1-1ubuntu2","1.17.1-1ubuntu3","1.17.4-1ubuntu1","1.17.6-1ubuntu1","1.17.6-1ubuntu2","1.17.6-1ubuntu3","1.17.6-1ubuntu4","1.17.6-1ubuntu4.1","1.17.6-1ubuntu4.2","1.17.6-1ubuntu4.3","1.17.6-1ubuntu4.4","1.17.6-1ubuntu4.5","1.17.6-1ubuntu4.6","1.17.6-1ubuntu4.7"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.1-1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.1-160000.1.1"}]}],"bundled":4}],"products":[{"vendor":"strukturag","product":"libheif"}],"references":[{"url":"https://github.com/strukturag/libheif/security/advisories/GHSA-jc8f-p23p-5hjg","tags":["x_refsource_CONFIRM","advisory","report"]},{"url":"https://github.com/strukturag/libheif/commit/f01870c1d7323a3003796d58eba7fff502be994c","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/strukturag/libheif/releases/tag/v1.23.1","tags":["x_refsource_MISC","web"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-62289","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/62xxx/CVE-2026-62289.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62289","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-62289","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623320-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1273079","tags":["report"]},{"url":"https://bugzilla.suse.com/1273080","tags":["report"]},{"url":"https://bugzilla.suse.com/1273081","tags":["report"]},{"url":"https://bugzilla.suse.com/1273082","tags":["report"]},{"url":"https://bugzilla.suse.com/1273083","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-62289","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-62291","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-62292","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-62377","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263597-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-62289","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-62289","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8649-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8683-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-62292","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-62291","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-62289","title":"libheif: Integer underflow in Fraction constructor via double clap transform application","description":"libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF or AVIF file containing a clean aperture box can reduce an image dimension to zero and crash or corrupt tiling results when heif_image_handle_get_image_tiling(handle, 1, \u0026tiling) is called. ImageItem::get_heif_image_tiling() returns already transformed dimensions, and process_image_transformations_on_tiling() applies the clean aperture transformation again. The second application passes zero to Box_clap::left_rounded(0), where image_width minus one underflows and constructs Fraction(0xFFFFFFFF, 2). Debug builds reach an assertion and abort, while release builds can return a corrupt crop and zero-width tiling result. The affected implementation spans libheif/image-items/image_item.cc, libheif/context.cc, and libheif/box.cc. This issue is fixed in version 1.23.1.","status":"published","published":"2026-08-18T21:19:18.107Z","modified":"2026-08-19T16:51:42.36Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-191","CWE-617"],"updated_at":"2026-11-02T14:20:14.999906Z"}],"euvd":[{"id":"EUVD-2026-62188","description":"libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF or AVIF file containing a clean aperture box can reduce an image dimension to zero and crash or corrupt tiling results when heif_image_handle_get_image_tiling(handle, 1, \u0026tiling) is called. ImageItem::get_heif_image_tiling() returns already transformed dimensions, and process_image_transformations_on_tiling() applies the clean aperture transformation again. The second application passes zero to Box_clap::left_rounded(0), where image_width minus one underflows and constructs Fraction(0xFFFFFFFF, 2). Debug builds reach an assertion and abort, while release builds can return a corrupt crop and zero-width tiling result. The affected implementation spans libheif/image-items/image_item.cc, libheif/context.cc, and libheif/box.cc. This issue is fixed in version 1.23.1.","status":"published","published":"2026-08-18T21:19:18Z","modified":"2026-08-19T16:51:42Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T18:01:41.405951Z"}],"nvd":[{"id":"CVE-2026-62289","description":"libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF or AVIF file containing a clean aperture box can reduce an image dimension to zero and crash or corrupt tiling results when heif_image_handle_get_image_tiling(handle, 1, \u0026tiling) is called. ImageItem::get_heif_image_tiling() returns already transformed dimensions, and process_image_transformations_on_tiling() applies the clean aperture transformation again. The second application passes zero to Box_clap::left_rounded(0), where image_width minus one underflows and constructs Fraction(0xFFFFFFFF, 2). Debug builds reach an assertion and abort, while release builds can return a corrupt crop and zero-width tiling result. The affected implementation spans libheif/image-items/image_item.cc, libheif/context.cc, and libheif/box.cc. This issue is fixed in version 1.23.1.","status":"published","published":"2026-08-18T22:17:02.72Z","modified":"2026-10-22T16:09:59.56Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-191","CWE-617"],"updated_at":"2026-11-02T14:12:39.620837Z"}],"osv":[{"id":"BELL-CVE-2026-62289","status":"published","published":"2026-08-15T06:06:32.472472Z","modified":"2026-10-02T07:15:04.803999666Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:28:24.959902Z"},{"id":"CVE-2026-62289","title":"libheif: Integer underflow in Fraction constructor via double clap transform application","description":"libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF or AVIF file containing a clean aperture box can reduce an image dimension to zero and crash or corrupt tiling results when heif_image_handle_get_image_tiling(handle, 1, \u0026tiling) is called. ImageItem::get_heif_image_tiling() returns already transformed dimensions, and process_image_transformations_on_tiling() applies the clean aperture transformation again. The second application passes zero to Box_clap::left_rounded(0), where image_width minus one underflows and constructs Fraction(0xFFFFFFFF, 2). Debug builds reach an assertion and abort, while release builds can return a corrupt crop and zero-width tiling result. The affected implementation spans libheif/image-items/image_item.cc, libheif/context.cc, and libheif/box.cc. This issue is fixed in version 1.23.1.","status":"published","published":"2026-08-18T21:19:18.107Z","modified":"2026-10-28T10:55:03.589107669Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-191","CWE-617"],"updated_at":"2026-11-02T15:45:13.306117Z"},{"id":"DEBIAN-CVE-2026-62289","description":"libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF or AVIF file containing a clean aperture box can reduce an image dimension to zero and crash or corrupt tiling results when heif_image_handle_get_image_tiling(handle, 1, \u0026tiling) is called. ImageItem::get_heif_image_tiling() returns already transformed dimensions, and process_image_transformations_on_tiling() applies the clean aperture transformation again. The second application passes zero to Box_clap::left_rounded(0), where image_width minus one underflows and constructs Fraction(0xFFFFFFFF, 2). Debug builds reach an assertion and abort, while release builds can return a corrupt crop and zero-width tiling result. The affected implementation spans libheif/image-items/image_item.cc, libheif/context.cc, and libheif/box.cc. This issue is fixed in version 1.23.1.","status":"published","published":"2026-08-18T22:17:02.72Z","modified":"2026-10-23T18:05:01.27797072Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:57.932517Z"},{"id":"UBUNTU-CVE-2026-62289","description":"libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF or AVIF file containing a clean aperture box can reduce an image dimension to zero and crash or corrupt tiling results when heif_image_handle_get_image_tiling(handle, 1, \u0026tiling) is called. ImageItem::get_heif_image_tiling() returns already transformed dimensions, and process_image_transformations_on_tiling() applies the clean aperture transformation again. The second application passes zero to Box_clap::left_rounded(0), where image_width minus one underflows and constructs Fraction(0xFFFFFFFF, 2). Debug builds reach an assertion and abort, while release builds can return a corrupt crop and zero-width tiling result. The affected implementation spans libheif/image-items/image_item.cc, libheif/context.cc, and libheif/box.cc. This issue is fixed in version 1.23.1.","status":"published","published":"2026-08-13T00:00:00Z","modified":"2026-09-02T19:36:26.657193799Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T16:56:43.630667Z"},{"id":"openSUSE-SU-2026:11416-1","title":"gdk-pixbuf-loader-libheif-1.23.1-1.1 on GA media","description":"These are all security issues fixed in the gdk-pixbuf-loader-libheif-1.23.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-01T00:00:00Z","modified":"2026-08-02T11:45:08.020230581Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:21644-1","title":"Security update for libheif","description":"This update for libheif fixes the following issues:\n\nUpdate to version 1.23.1 (jsc#PED-16355).\n\nSecurity issues fixed:\n\n- CVE-2026-62289: integer underflow in Fraction constructor via double clap transform application (bsc#1273079).\n- CVE-2026-62291: heap out-of-bounds write in the uncompressed encoder when writing images with mismatched auxiliary\n  alpha dimensions (bsc#1273080).\n- CVE-2026-62292: out-of-bounds read in uncompressed unci tile range slicing (bsc#1273081).\n- CVE-2026-62377: reachable assertion in `HeifContext::get_track()` aborts on a valid-but-empty HEIF sequence file\n  (bsc#1273082).\n- Heap out-of-bounds write in the uncompressed encoder for RRGGBB images with interleaved bit-depth `\u003c= 8`\n  (bsc#1273083).\n\nChanges for libheif:\n\n- Version 1.23.1\n  + FFmpeg decoder plugin gains AV1, VVC, JPEG, and JPEG 2000/HTJ2K decoding.\n  + SVT-AV1 encoder: new `tune=iq` and `ms-ssim` tune parameters.\n  + C++ API: added getters/setters for the CLLI and MDCV HDR metadata boxes.\n  + Sequence decoder now scales the alpha auxiliary track to the main image size.\n  + Fixed pixi box writing for multi-channel images.\n  + Corrected the placement of the TAI `clock_type` field into the top 2 bits.\n  + Empty/unset plugin directory is no longer scanned.\n","status":"published","published":"2026-08-25T06:33:48Z","modified":"2026-08-27T18:23:13.590222309Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:23320-1","title":"Security update for libheif","description":"This update for libheif fixes the following issues:\n\nUpdate to version 1.23.1 (jsc#PED-16355).\n\nSecurity issues fixed:\n\n- CVE-2026-62289: integer underflow in Fraction constructor via double clap transform application (bsc#1273079).\n- CVE-2026-62291: heap out-of-bounds write in the uncompressed encoder when writing images with mismatched auxiliary\n  alpha dimensions (bsc#1273080).\n- CVE-2026-62292: out-of-bounds read in uncompressed unci tile range slicing (bsc#1273081).\n- CVE-2026-62377: reachable assertion in `HeifContext::get_track()` aborts on a valid-but-empty HEIF sequence file\n  (bsc#1273082).\n- Heap out-of-bounds write in the uncompressed encoder for RRGGBB images with interleaved bit-depth `\u003c= 8`\n  (bsc#1273083).\n\nChanges for libheif:\n\n- Version 1.23.1\n  + FFmpeg decoder plugin gains AV1, VVC, JPEG, and JPEG 2000/HTJ2K decoding.\n  + SVT-AV1 encoder: new `tune=iq` and `ms-ssim` tune parameters.\n  + C++ API: added getters/setters for the CLLI and MDCV HDR metadata boxes.\n  + Sequence decoder now scales the alpha auxiliary track to the main image size.\n  + Fixed pixi box writing for multi-channel images.\n  + Corrected the placement of the TAI `clock_type` field into the top 2 bits.\n  + Empty/unset plugin directory is no longer scanned.\n","status":"published","published":"2026-08-25T06:32:48Z","modified":"2026-09-10T18:23:10.51923243Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:3597-1","title":"Security update for libheif","description":"This update for libheif fixes the following issues:\n\nUpdate to version 1.23.1 (jsc#PED-16355).\n\nSecurity issues fixed:\n\n- CVE-2026-62289: integer underflow in Fraction constructor via double clap transform application (bsc#1273079).\n- CVE-2026-62291: heap out-of-bounds write in the uncompressed encoder when writing images with mismatched auxiliary\n  alpha dimensions (bsc#1273080).\n- CVE-2026-62292: out-of-bounds read in uncompressed unci tile range slicing (bsc#1273081).\n- CVE-2026-62377: reachable assertion in `HeifContext::get_track()` aborts on a valid-but-empty HEIF sequence file\n  (bsc#1273082).\n- Heap out-of-bounds write in the uncompressed encoder for RRGGBB images with interleaved bit-depth `\u003c= 8`\n  (bsc#1273083).\n\nChanges for libheif:\n\n- Version 1.23.1\n  + FFmpeg decoder plugin gains AV1, VVC, JPEG, and JPEG 2000/HTJ2K decoding.\n  + SVT-AV1 encoder: new `tune=iq` and `ms-ssim` tune parameters.\n  + C++ API: added getters/setters for the CLLI and MDCV HDR metadata boxes.\n  + Sequence decoder now scales the alpha auxiliary track to the main image size.\n  + Fixed pixi box writing for multi-channel images.\n  + Corrected the placement of the TAI `clock_type` field into the top 2 bits.\n  + Empty/unset plugin directory is no longer scanned.\n","status":"published","published":"2026-08-12T11:48:46Z","modified":"2026-08-13T09:30:09.120531898Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"USN-8649-1","title":"libheif vulnerabilities","description":"It was discovered that libheif had an integer underflow in the Fraction\nconstructor when a clap transform was applied twice. An attacker could\npossibly use this issue to cause libheif to crash, resulting in a denial of\nservice. (CVE-2026-62289)\n\nIt was discovered that libheif had an out-of-bounds read in uncompressed\ntile range slicing. An attacker could possibly use this issue to cause\nlibheif to crash, resulting in a denial of service. This issue only\naffected Ubuntu 25.10. (CVE-2026-62292)","status":"published","published":"2026-08-19T12:39:30Z","modified":"2026-08-20T10:45:55.478236781Z","updated_at":"2026-11-02T16:58:25.103481Z"},{"id":"USN-8683-1","title":"libheif vulnerabilities","description":"Feng Ning discovered that libheif incorrectly handled certain image\ntransforms. A remote attacker could possibly use this issue to cause a\ndenial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu\n20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2026-62289)\n\nAli Firas discovered that libheif incorrectly handled certain images. An\nattacker could possibly use this issue to cause a denial of service or\nexecute arbitrary code. This issue only affected Ubuntu 24.04 LTS.\n(CVE-2026-62291)","status":"published","published":"2026-08-26T16:56:18Z","modified":"2026-08-31T17:25:55.503479316Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}