CVE-2026-62291: libheif: Heap out of bounds write in libheif uncompressed encoder when writing images with mismatched auxiliary alpha dimensions

Published Aug 18, 2026
·
Updated

Last updated 18 September 2026

Other sources

libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted image sequence with a 2x2 primary plane and a 256x256 auxiliary alpha plane can cause attacker-controlled heap corruption during a normal decode and re-encode workflow. TrackVisual::decodenextimagesample() calls transferchannelfromimageas() without checking that the auxiliary alpha dimensions match the main frame. The resulting inconsistent image reaches heiftrackdecodenextimage() and then heifcontextencodeimage(). In uncencoder::encode(), uncencodercomponentinterleave::encodetile() sizes its buffer with computetiledatasizebytes() using the primary dimensions but copies each component using its actual plane dimensions. The oversized alpha plane is therefore copied beyond the allocation, causing an out-of-bounds write; the inverse size mismatch can also produce an out-of-bounds read. This issue is fixed in version 1.23.1.

— MITRE

Affected Software

2 affected componentsFixes available
libheif<=1.23.0
debian/libheif
1.15.1-1+deb12u11.19.8-1+deb13u11.23.3-11.23.4-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade debian/libheif to a version that resolves this vulnerability.

    Fixed in 1.15.1-1+deb12u1Fixed in 1.19.8-1+deb13u1Fixed in 1.23.3-1Fixed in 1.23.4-1
  2. Upgrade

    Upgrade libheif to a version that resolves this vulnerability.

    Fixed in 1.23.1

Event History

Aug 18, 2026
CVE Published
via MITRE·09:21 PM
Data Sourced
via MITRE·09:21 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·10:17 PM
DescriptionSeverityWeakness
Aug 26, 2026
Data Sourced
via Launchpad·11:21 PM
Description
Sep 17, 2026
Data Sourced
via Debian·10:33 PM
DescriptionAffected Software
Sep 18, 2026
Data Sourced
via Ubuntu·10:33 PM
RemedyDescriptionSeverityAffected Software

Frequently Asked Questions

1

Which deployments are realistically exposed?

Systems using libheif 1.23.0 or earlier are affected when they process attacker-controlled image sequences through a decode-and-re-encode workflow. The vulnerable path involves an auxiliary alpha plane whose dimensions do not match the primary image plane.

2

What input and processing path are required for exploitation?

An attacker needs to provide a crafted image sequence with mismatched primary and auxiliary alpha dimensions and have it processed normally by the affected decode-and-re-encode path. The described example uses a 2x2 primary plane and a 256x256 auxiliary alpha plane.

3

What version resolves the vulnerability?

Upgrade libheif to version 1.23.1, which fixes the issue. The provided data does not specify an alternative mitigation for environments that cannot upgrade immediately.

4

How can I identify potentially affected processing?

Review whether your application accepts image sequences with auxiliary alpha planes and passes them from decoding into libheif encoding. Inputs with auxiliary alpha dimensions that differ from the corresponding main-frame dimensions indicate exposure to the vulnerable condition.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203