CVE-2026-62289
published 2026-08-18CVE-2026-62289: libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF or AVIF file containing a clean aperture box can reduce an…
PriorityP420medium4.3CVSS 3.1
AVNACLPRNUIRSUCNINAL
EPSS
0.30%
23.1th percentile
libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF or AVIF file containing a clean aperture box can reduce an image dimension to zero and crash or corrupt tiling results when heif_image_handle_get_image_tiling(handle, 1, &tiling) is called. ImageItem::get_heif_image_tiling() returns already transformed dimensions, and process_image_transformations_on_tiling() applies the clean aperture transformation again. The second application passes zero to Box_clap::left_rounded(0), where image_width minus one underflows and constructs Fraction(0xFFFFFFFF, 2). Debug builds reach an assertion and abort, while release builds can return a corrupt crop and zero-width tiling result. The affected implementation spans libheif/image-items/image_item.cc, libheif/context.cc, and libheif/box.cc. This issue is fixed in version 1.23.1.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| strukturag | libheif | — | — |
| ubuntu | libheif | — | — |
CVSS provenance
nvdv3.14.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
vendor_ubuntu4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
libheif vulnerabilities
vendor_ubuntu·2026-08-26·CVSS 4.3
CVE-2026-62291 [MEDIUM] libheif vulnerabilities
Title: libheif vulnerabilities
Summary: Several security issues were fixed in libheif.
Feng Ning discovered that libheif incorrectly handled certain image
transforms. A remote attacker could possibly use this issue to cause a
denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu
20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2026-62289)
Ali Firas discovered that libheif incorrectly handled certain images. An
attacker could possibly use this issue to cause a denial of service or
execute arbitrary code. This issue only affected Ubuntu 24.04 LTS.
(CVE-2026-62291)
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
libheif vulnerabilities
vendor_ubuntu·2026-08-19·CVSS 4.3
CVE-2026-62289 [MEDIUM] libheif vulnerabilities
Title: libheif vulnerabilities
Summary: Several security issues were fixed in libheif.
It was discovered that libheif had an integer underflow in the Fraction
constructor when a clap transform was applied twice. An attacker could
possibly use this issue to cause libheif to crash, resulting in a denial of
service. (CVE-2026-62289)
It was discovered that libheif had an out-of-bounds read in uncompressed
tile range slicing. An attacker could possibly use this issue to cause
libheif to crash, resulting in a denial of service. This issue only
affected Ubuntu 25.10. (CVE-2026-62292)
Instructions: In general, a standard system update will make all the necessary changes.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-62289 libheif: libheif: Denial of Service or data corruption via crafted HEIF/AVIF file [fedora-all]
bugzilla·2026-08-24·CVSS 4.3
CVE-2026-62289 [MEDIUM] CVE-2026-62289 libheif: libheif: Denial of Service or data corruption via crafted HEIF/AVIF file [fedora-all]
CVE-2026-62289 libheif: libheif: Denial of Service or data corruption via crafted HEIF/AVIF file [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF or AVIF file containing a clean aperture box can reduce an image dimension to zero and crash or corrupt tiling results when heif_image_handle_get_image_tiling(handle, 1, &tiling) is called. ImageItem::get_heif_image_tiling() returns already transformed dimensions, and process_image_transformations_on_tiling() applies the clean aperture transformation again. The se
Bugzilla
CVE-2026-62289 libheif: libheif: Denial of Service or data corruption via crafted HEIF/AVIF file [epel-all]
bugzilla·2026-08-24·CVSS 4.3
CVE-2026-62289 [MEDIUM] CVE-2026-62289 libheif: libheif: Denial of Service or data corruption via crafted HEIF/AVIF file [epel-all]
CVE-2026-62289 libheif: libheif: Denial of Service or data corruption via crafted HEIF/AVIF file [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF or AVIF file containing a clean aperture box can reduce an image dimension to zero and crash or corrupt tiling results when heif_image_handle_get_image_tiling(handle, 1, &tiling) is called. ImageItem::get_heif_image_tiling() returns already transformed dimensions, and process_image_transformations_on_tiling() applies the clean aperture transformation again. The seco
Bugzilla
CVE-2026-62289 libheif: libheif: Denial of Service or data corruption via crafted HEIF/AVIF file
bugzilla·2026-08-18·CVSS 4.3
CVE-2026-62289 [MEDIUM] CVE-2026-62289 libheif: libheif: Denial of Service or data corruption via crafted HEIF/AVIF file
CVE-2026-62289 libheif: libheif: Denial of Service or data corruption via crafted HEIF/AVIF file
libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF or AVIF file containing a clean aperture box can reduce an image dimension to zero and crash or corrupt tiling results when heif_image_handle_get_image_tiling(handle, 1, &tiling) is called. ImageItem::get_heif_image_tiling() returns already transformed dimensions, and process_image_transformations_on_tiling() applies the clean aperture transformation again. The second application passes zero to Box_clap::left_rounded(0), where image_width minus one underflows and constructs Fraction(0xFFFFFFFF, 2). Debug builds reach an assertion and abort, while release builds can return a corrupt crop and zero-w
2026-08-18
Published