CVE-2026-62289: libheif: Integer underflow in Fraction constructor via double clap transform application

Published Aug 18, 2026
·
Updated

libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF or AVIF file containing a clean aperture box can reduce an image dimension to zero and crash or corrupt tiling results when heifimagehandlegetimagetiling(handle, 1, &tiling) is called. ImageItem::getheifimagetiling() returns already transformed dimensions, and processimagetransformationsontiling() applies the clean aperture transformation again. The second application passes zero to Boxclap::leftrounded(0), where imagewidth minus one underflows and constructs Fraction(0xFFFFFFFF, 2). Debug builds reach an assertion and abort, while release builds can return a corrupt crop and zero-width tiling result. The affected implementation spans libheif/image-items/imageitem.cc, libheif/context.cc, and libheif/box.cc. This issue is fixed in version 1.23.1.

Affected Software

1 affected component
libheif<=1.23.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade libheif to a version that resolves this vulnerability.

    Fixed in 1.23.1

Event History

Aug 18, 2026
CVE Published
via MITRE·09:19 PM
Data Sourced
via MITRE·09:19 PM
DescriptionSeverityWeakness

Frequently Asked Questions

1

Which deployments are realistically exposed?

Applications that process untrusted HEIF or AVIF files and call heif_image_handle_get_image_tiling(handle, 1, &tiling) are exposed. The issue is triggered by a crafted file containing a clean aperture box.

2

What does exploitation require?

An attacker needs to persuade the application to process a crafted HEIF or AVIF file; no authentication or prior privileges are required. User interaction is required, consistent with a user opening or otherwise causing processing of the malicious file.

3

What is the likely impact in debug versus release builds?

Debug builds can hit an assertion and abort. Release builds can return a corrupt crop and a zero-width tiling result when the affected tiling API path is used.

4

What mitigation is available before patching?

Upgrade libheif to version 1.23.1. If upgrading is not immediately possible, avoid calling heif_image_handle_get_image_tiling with transformed tiling enabled on untrusted HEIF or AVIF inputs containing clean aperture data.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203