CVE-2026-62291: libheif: Heap out of bounds write in libheif uncompressed encoder when writing images with mismatched auxiliary alpha dimensions
Last updated 18 September 2026
Other sources
libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted image sequence with a 2x2 primary plane and a 256x256 auxiliary alpha plane can cause attacker-controlled heap corruption during a normal decode and re-encode workflow. TrackVisual::decodenextimagesample() calls transferchannelfromimageas() without checking that the auxiliary alpha dimensions match the main frame. The resulting inconsistent image reaches heiftrackdecodenextimage() and then heifcontextencodeimage(). In uncencoder::encode(), uncencodercomponentinterleave::encodetile() sizes its buffer with computetiledatasizebytes() using the primary dimensions but copies each component using its actual plane dimensions. The oversized alpha plane is therefore copied beyond the allocation, causing an out-of-bounds write; the inverse size mismatch can also produce an out-of-bounds read. This issue is fixed in version 1.23.1.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/libheifto a version that resolves this vulnerability.Fixed in 1.15.1-1+deb12u1Fixed in 1.19.8-1+deb13u1Fixed in 1.23.3-1Fixed in 1.23.4-1 - Upgrade
Upgrade
libheifto a version that resolves this vulnerability.Fixed in 1.23.1
Event History
Frequently Asked Questions
Which deployments are realistically exposed?
Systems using libheif 1.23.0 or earlier are affected when they process attacker-controlled image sequences through a decode-and-re-encode workflow. The vulnerable path involves an auxiliary alpha plane whose dimensions do not match the primary image plane.
What input and processing path are required for exploitation?
An attacker needs to provide a crafted image sequence with mismatched primary and auxiliary alpha dimensions and have it processed normally by the affected decode-and-re-encode path. The described example uses a 2x2 primary plane and a 256x256 auxiliary alpha plane.
What version resolves the vulnerability?
Upgrade libheif to version 1.23.1, which fixes the issue. The provided data does not specify an alternative mitigation for environments that cannot upgrade immediately.
How can I identify potentially affected processing?
Review whether your application accepts image sequences with auxiliary alpha planes and passes them from decoding into libheif encoding. Inputs with auxiliary alpha dimensions that differ from the corresponding main-frame dimensions indicate exposure to the vulnerable condition.