CVE-2026-62289: libheif: Integer underflow in Fraction constructor via double clap transform application
Last updated 27 August 2026
Other sources
libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF or AVIF file containing a clean aperture box can reduce an image dimension to zero and crash or corrupt tiling results when heifimagehandlegetimagetiling(handle, 1, &tiling) is called. ImageItem::getheifimagetiling() returns already transformed dimensions, and processimagetransformationsontiling() applies the clean aperture transformation again. The second application passes zero to Boxclap::leftrounded(0), where imagewidth minus one underflows and constructs Fraction(0xFFFFFFFF, 2). Debug builds reach an assertion and abort, while release builds can return a corrupt crop and zero-width tiling result. The affected implementation spans libheif/image-items/imageitem.cc, libheif/context.cc, and libheif/box.cc. This issue is fixed in version 1.23.1.
— Debian
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/libheifto a version that resolves this vulnerability.Fixed in 1.19.8-1+deb13u1Fixed in 1.23.1-1 - Upgrade
Upgrade
libheifto a version that resolves this vulnerability.Fixed in 1.23.1 - Operational
After upgrading to libheif 1.23.1, retest any HEIF/AVIF image tiling calls (e.g., heif_image_handle_get_image_tiling(handle, 1, &tiling)) to ensure corrupt/zero-width tiling results no longer occur when clean aperture boxes are present.
Event History
Frequently Asked Questions
Which deployments are realistically exposed?
Applications that process untrusted HEIF or AVIF files and call heif_image_handle_get_image_tiling(handle, 1, &tiling) are exposed. The issue is triggered by a crafted file containing a clean aperture box.
What does exploitation require?
An attacker needs to persuade the application to process a crafted HEIF or AVIF file; no authentication or prior privileges are required. User interaction is required, consistent with a user opening or otherwise causing processing of the malicious file.
What is the likely impact in debug versus release builds?
Debug builds can hit an assertion and abort. Release builds can return a corrupt crop and a zero-width tiling result when the affected tiling API path is used.
What mitigation is available before patching?
Upgrade libheif to version 1.23.1. If upgrading is not immediately possible, avoid calling heif_image_handle_get_image_tiling with transformed tiling enabled on untrusted HEIF or AVIF inputs containing clean aperture data.