{"id":"CVE-2026-62292","aliases":["BELL-CVE-2026-62292","DEBIAN-CVE-2026-62292","EUVD-2026-62189","GHSA-73p7-m7gg-w2jv","ROOT-OS-DEBIAN-11-CVE-2026-62292","ROOT-OS-DEBIAN-12-CVE-2026-62292","SUSE-SU-2026:23320-1","SUSE-SU-2026:3597-1","UBUNTU-CVE-2026-62292","openSUSE-SU-2026:11416-1","openSUSE-SU-2026:21644-1"],"status":"published","title":"libheif: Out-of-bounds read in uncompressed unci tile range slicing","description":"libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.1, a crafted uncompressed HEIF image using generic zlib unci full-item compression can crash an application that decodes an advertised tile with heif_image_handle_decode_image_tile(). In libheif/codecs/uncompressed/unc_decoder.cc, unc_decoder::fetch_tile_data() computes a large tile offset and unc_decoder::get_compressed_image_data_uncompressed() validates it with range_start_offset plus range_size. For the last advertised tile (4095, 4095), the addition can wrap to zero, bypass the bounds check, and pass an invalid source pointer and a one-terabyte length to memcpy. The observed result is an out-of-bounds read and process crash; opening the file alone does not trigger the issue because tile decoding is required. This issue is fixed in version 1.23.1.","severity":{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00562,"percentile":0.47064,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2026-08-01T00:00:00Z","modified":"2026-11-03T13:15:03Z","fixes":[{"ecosystem":"Alpaquita:stream","package":"libheif","fixed_in":["1.23.4-r0"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libheif","fixed_in":["1.19.8-1+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libheif","fixed_in":["1.23.1-1"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"libheif","fixed_in":["1.11.0-1+deb11u2.aikido.6"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"rootio-libheif","fixed_in":["1.11.0-1+deb11u2.aikido.6"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"libheif","fixed_in":["1.15.1-1+deb12u1.aikido.13","1.15.1-1+deb12u1.aikido.14","1.15.1-1+deb12u1.aikido.15","1.15.1-1+deb12u1.aikido.16","1.15.1-1+deb12u1.aikido.17"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-libheif","fixed_in":["1.15.1-1+deb12u1.aikido.13","1.15.1-1+deb12u1.aikido.14","1.15.1-1+deb12u1.aikido.15","1.15.1-1+deb12u1.aikido.16","1.15.1-1+deb12u1.aikido.17"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"libheif","fixed_in":["1.21.2-3ubuntu0.4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpaquita:stream","package":"libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.20.2-r2"},{"fixed":"1.23.4-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.15.1-1","1.15.1-1+deb12u1","1.16.2-1","1.16.2-2","1.16.2-3","1.17.0-1","1.17.1-1","1.17.4-1","1.17.6-1","1.17.6-2","1.17.6-3","1.17.6-4","1.18.1-1","1.18.1-2","1.18.2-1","1.18.2-2","1.19.1-1","1.19.1-1~bpo12+1","1.19.1-1~bpo12+2","1.19.3-1","1.19.3-1~bpo12+1","1.19.5-1","1.19.7-1","1.19.7-1~bpo12+1","1.19.8-1","1.20.1-1","1.20.2-1","1.20.2-2","1.21.2-1","1.21.2-2","1.21.2-3","1.21.2-4","1.23.1-1","1.23.2-1","1.23.3-1","1.23.4-1","1.23.4-1~deb13u1","1.23.6-1","1.23.6-2"]},{"source":"osv","ecosystem":"Debian:13","package":"libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.8-1+deb13u1"}]}],"versions":["1.19.8-1"]},{"source":"osv","ecosystem":"Debian:14","package":"libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.1-1"}]}],"versions":["1.19.8-1","1.20.1-1","1.20.2-1","1.20.2-2","1.21.2-1","1.21.2-2","1.21.2-3","1.21.2-4"]},{"source":"osv","ecosystem":"Root:Debian:11","package":"libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-1+deb11u2.aikido.6"}]}]},{"source":"osv","ecosystem":"Root:Debian:11","package":"rootio-libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-1+deb11u2.aikido.6"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.1-1+deb12u1.aikido.13"},{"fixed":"1.15.1-1+deb12u1.aikido.14"},{"fixed":"1.15.1-1+deb12u1.aikido.15"},{"fixed":"1.15.1-1+deb12u1.aikido.16"},{"fixed":"1.15.1-1+deb12u1.aikido.17"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.1-1+deb12u1.aikido.13"},{"fixed":"1.15.1-1+deb12u1.aikido.14"},{"fixed":"1.15.1-1+deb12u1.aikido.15"},{"fixed":"1.15.1-1+deb12u1.aikido.16"},{"fixed":"1.15.1-1+deb12u1.aikido.17"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.1-160000.1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.1-160000.1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP7","package":"libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.1-150700.3.18.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.1-150700.3.18.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.2-3ubuntu0.4"}]}],"versions":["1.20.2-1","1.20.2-2","1.20.2-2build1","1.20.2-2build2","1.20.2-2ubuntu1","1.21.2-1","1.21.2-3","1.21.2-3ubuntu0.1","1.21.2-3ubuntu0.2","1.21.2-3ubuntu0.3"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.1-1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.1-160000.1.1"}]}],"bundled":4}],"products":[{"vendor":"strukturag","product":"libheif"}],"references":[{"url":"https://github.com/strukturag/libheif/security/advisories/GHSA-73p7-m7gg-w2jv","tags":["x_refsource_CONFIRM","exploit","advisory","report"]},{"url":"https://github.com/strukturag/libheif/commit/089a809bf6bed1abae102d5e97b6bb8c4f53b515","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/strukturag/libheif/releases/tag/v1.23.1","tags":["x_refsource_MISC","web"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-62292","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/62xxx/CVE-2026-62292.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62292","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-62292","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623320-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1273079","tags":["report"]},{"url":"https://bugzilla.suse.com/1273080","tags":["report"]},{"url":"https://bugzilla.suse.com/1273081","tags":["report"]},{"url":"https://bugzilla.suse.com/1273082","tags":["report"]},{"url":"https://bugzilla.suse.com/1273083","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-62289","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-62291","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-62292","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-62377","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263597-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-62292","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-62292","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8649-1","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-62292","title":"libheif: Out-of-bounds read in uncompressed unci tile range slicing","description":"libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.1, a crafted uncompressed HEIF image using generic zlib unci full-item compression can crash an application that decodes an advertised tile with heif_image_handle_decode_image_tile(). In libheif/codecs/uncompressed/unc_decoder.cc, unc_decoder::fetch_tile_data() computes a large tile offset and unc_decoder::get_compressed_image_data_uncompressed() validates it with range_start_offset plus range_size. For the last advertised tile (4095, 4095), the addition can wrap to zero, bypass the bounds check, and pass an invalid source pointer and a one-terabyte length to memcpy. The observed result is an out-of-bounds read and process crash; opening the file alone does not trigger the issue because tile decoding is required. This issue is fixed in version 1.23.1.","status":"published","published":"2026-08-18T21:20:24.933Z","modified":"2026-08-25T01:43:35.289Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:20:14.999906Z"}],"euvd":[{"id":"EUVD-2026-62189","description":"libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.1, a crafted uncompressed HEIF image using generic zlib unci full-item compression can crash an application that decodes an advertised tile with heif_image_handle_decode_image_tile(). In libheif/codecs/uncompressed/unc_decoder.cc, unc_decoder::fetch_tile_data() computes a large tile offset and unc_decoder::get_compressed_image_data_uncompressed() validates it with range_start_offset plus range_size. For the last advertised tile (4095, 4095), the addition can wrap to zero, bypass the bounds check, and pass an invalid source pointer and a one-terabyte length to memcpy. The observed result is an out-of-bounds read and process crash; opening the file alone does not trigger the issue because tile decoding is required. This issue is fixed in version 1.23.1.","status":"published","published":"2026-08-18T21:20:24Z","modified":"2026-08-25T01:43:35Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T18:01:33.760029Z"}],"nvd":[{"id":"CVE-2026-62292","description":"libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.1, a crafted uncompressed HEIF image using generic zlib unci full-item compression can crash an application that decodes an advertised tile with heif_image_handle_decode_image_tile(). In libheif/codecs/uncompressed/unc_decoder.cc, unc_decoder::fetch_tile_data() computes a large tile offset and unc_decoder::get_compressed_image_data_uncompressed() validates it with range_start_offset plus range_size. For the last advertised tile (4095, 4095), the addition can wrap to zero, bypass the bounds check, and pass an invalid source pointer and a one-terabyte length to memcpy. The observed result is an out-of-bounds read and process crash; opening the file alone does not trigger the issue because tile decoding is required. This issue is fixed in version 1.23.1.","status":"published","published":"2026-08-18T22:17:03.023Z","modified":"2026-10-22T16:09:59.56Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:12:39.620837Z"}],"osv":[{"id":"CVE-2026-62292","title":"libheif: Out-of-bounds read in uncompressed unci tile range slicing","description":"libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.1, a crafted uncompressed HEIF image using generic zlib unci full-item compression can crash an application that decodes an advertised tile with heif_image_handle_decode_image_tile(). In libheif/codecs/uncompressed/unc_decoder.cc, unc_decoder::fetch_tile_data() computes a large tile offset and unc_decoder::get_compressed_image_data_uncompressed() validates it with range_start_offset plus range_size. For the last advertised tile (4095, 4095), the addition can wrap to zero, bypass the bounds check, and pass an invalid source pointer and a one-terabyte length to memcpy. The observed result is an out-of-bounds read and process crash; opening the file alone does not trigger the issue because tile decoding is required. This issue is fixed in version 1.23.1.","status":"published","published":"2026-08-18T21:20:24.933Z","modified":"2026-10-28T10:55:03.21532709Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:45:13.306117Z"},{"id":"DEBIAN-CVE-2026-62292","description":"libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.1, a crafted uncompressed HEIF image using generic zlib unci full-item compression can crash an application that decodes an advertised tile with heif_image_handle_decode_image_tile(). In libheif/codecs/uncompressed/unc_decoder.cc, unc_decoder::fetch_tile_data() computes a large tile offset and unc_decoder::get_compressed_image_data_uncompressed() validates it with range_start_offset plus range_size. For the last advertised tile (4095, 4095), the addition can wrap to zero, bypass the bounds check, and pass an invalid source pointer and a one-terabyte length to memcpy. The observed result is an out-of-bounds read and process crash; opening the file alone does not trigger the issue because tile decoding is required. This issue is fixed in version 1.23.1.","status":"published","published":"2026-08-18T22:17:03.023Z","modified":"2026-10-23T18:05:39.873440538Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:45:57.932517Z"},{"id":"UBUNTU-CVE-2026-62292","description":"libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.1, a crafted uncompressed HEIF image using generic zlib unci full-item compression can crash an application that decodes an advertised tile with heif_image_handle_decode_image_tile(). In libheif/codecs/uncompressed/unc_decoder.cc, unc_decoder::fetch_tile_data() computes a large tile offset and unc_decoder::get_compressed_image_data_uncompressed() validates it with range_start_offset plus range_size. For the last advertised tile (4095, 4095), the addition can wrap to zero, bypass the bounds check, and pass an invalid source pointer and a one-terabyte length to memcpy. The observed result is an out-of-bounds read and process crash; opening the file alone does not trigger the issue because tile decoding is required. This issue is fixed in version 1.23.1.","status":"published","published":"2026-08-13T00:00:00Z","modified":"2026-09-02T19:36:20.533746916Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T16:56:43.630667Z"},{"id":"BELL-CVE-2026-62292","status":"published","published":"2026-08-15T06:06:32.531237Z","modified":"2026-10-02T07:15:04.231638441Z","updated_at":"2026-11-02T15:28:24.959902Z"},{"id":"openSUSE-SU-2026:11416-1","title":"gdk-pixbuf-loader-libheif-1.23.1-1.1 on GA media","description":"These are all security issues fixed in the gdk-pixbuf-loader-libheif-1.23.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-01T00:00:00Z","modified":"2026-08-02T11:45:08.020230581Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:21644-1","title":"Security update for libheif","description":"This update for libheif fixes the following issues:\n\nUpdate to version 1.23.1 (jsc#PED-16355).\n\nSecurity issues fixed:\n\n- CVE-2026-62289: integer underflow in Fraction constructor via double clap transform application (bsc#1273079).\n- CVE-2026-62291: heap out-of-bounds write in the uncompressed encoder when writing images with mismatched auxiliary\n  alpha dimensions (bsc#1273080).\n- CVE-2026-62292: out-of-bounds read in uncompressed unci tile range slicing (bsc#1273081).\n- CVE-2026-62377: reachable assertion in `HeifContext::get_track()` aborts on a valid-but-empty HEIF sequence file\n  (bsc#1273082).\n- Heap out-of-bounds write in the uncompressed encoder for RRGGBB images with interleaved bit-depth `\u003c= 8`\n  (bsc#1273083).\n\nChanges for libheif:\n\n- Version 1.23.1\n  + FFmpeg decoder plugin gains AV1, VVC, JPEG, and JPEG 2000/HTJ2K decoding.\n  + SVT-AV1 encoder: new `tune=iq` and `ms-ssim` tune parameters.\n  + C++ API: added getters/setters for the CLLI and MDCV HDR metadata boxes.\n  + Sequence decoder now scales the alpha auxiliary track to the main image size.\n  + Fixed pixi box writing for multi-channel images.\n  + Corrected the placement of the TAI `clock_type` field into the top 2 bits.\n  + Empty/unset plugin directory is no longer scanned.\n","status":"published","published":"2026-08-25T06:33:48Z","modified":"2026-08-27T18:23:13.590222309Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"ROOT-OS-DEBIAN-11-CVE-2026-62292","title":"CVE-2026-62292 in libheif - Patched by Root","description":"Root has patched CVE-2026-62292 in the libheif package for Root:Debian:11. Multiple fixed versions available.","status":"published","published":"2026-08-21T13:48:15Z","modified":"2026-08-21T15:00:04.869615033Z","updated_at":"2026-11-02T15:53:30.44348Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2026-62292","title":"CVE-2026-62292 in libheif - Patched by Root","description":"Root has patched CVE-2026-62292 in the libheif package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-11-03T12:12:10Z","modified":"2026-11-03T13:15:03.864478123Z","updated_at":"2026-11-03T13:33:04.521148Z"},{"id":"SUSE-SU-2026:23320-1","title":"Security update for libheif","description":"This update for libheif fixes the following issues:\n\nUpdate to version 1.23.1 (jsc#PED-16355).\n\nSecurity issues fixed:\n\n- CVE-2026-62289: integer underflow in Fraction constructor via double clap transform application (bsc#1273079).\n- CVE-2026-62291: heap out-of-bounds write in the uncompressed encoder when writing images with mismatched auxiliary\n  alpha dimensions (bsc#1273080).\n- CVE-2026-62292: out-of-bounds read in uncompressed unci tile range slicing (bsc#1273081).\n- CVE-2026-62377: reachable assertion in `HeifContext::get_track()` aborts on a valid-but-empty HEIF sequence file\n  (bsc#1273082).\n- Heap out-of-bounds write in the uncompressed encoder for RRGGBB images with interleaved bit-depth `\u003c= 8`\n  (bsc#1273083).\n\nChanges for libheif:\n\n- Version 1.23.1\n  + FFmpeg decoder plugin gains AV1, VVC, JPEG, and JPEG 2000/HTJ2K decoding.\n  + SVT-AV1 encoder: new `tune=iq` and `ms-ssim` tune parameters.\n  + C++ API: added getters/setters for the CLLI and MDCV HDR metadata boxes.\n  + Sequence decoder now scales the alpha auxiliary track to the main image size.\n  + Fixed pixi box writing for multi-channel images.\n  + Corrected the placement of the TAI `clock_type` field into the top 2 bits.\n  + Empty/unset plugin directory is no longer scanned.\n","status":"published","published":"2026-08-25T06:32:48Z","modified":"2026-09-10T18:23:10.51923243Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:3597-1","title":"Security update for libheif","description":"This update for libheif fixes the following issues:\n\nUpdate to version 1.23.1 (jsc#PED-16355).\n\nSecurity issues fixed:\n\n- CVE-2026-62289: integer underflow in Fraction constructor via double clap transform application (bsc#1273079).\n- CVE-2026-62291: heap out-of-bounds write in the uncompressed encoder when writing images with mismatched auxiliary\n  alpha dimensions (bsc#1273080).\n- CVE-2026-62292: out-of-bounds read in uncompressed unci tile range slicing (bsc#1273081).\n- CVE-2026-62377: reachable assertion in `HeifContext::get_track()` aborts on a valid-but-empty HEIF sequence file\n  (bsc#1273082).\n- Heap out-of-bounds write in the uncompressed encoder for RRGGBB images with interleaved bit-depth `\u003c= 8`\n  (bsc#1273083).\n\nChanges for libheif:\n\n- Version 1.23.1\n  + FFmpeg decoder plugin gains AV1, VVC, JPEG, and JPEG 2000/HTJ2K decoding.\n  + SVT-AV1 encoder: new `tune=iq` and `ms-ssim` tune parameters.\n  + C++ API: added getters/setters for the CLLI and MDCV HDR metadata boxes.\n  + Sequence decoder now scales the alpha auxiliary track to the main image size.\n  + Fixed pixi box writing for multi-channel images.\n  + Corrected the placement of the TAI `clock_type` field into the top 2 bits.\n  + Empty/unset plugin directory is no longer scanned.\n","status":"published","published":"2026-08-12T11:48:46Z","modified":"2026-08-13T09:30:09.120531898Z","updated_at":"2026-11-02T15:54:05.392906Z"}]}}