CVE-2026-62292: libheif: Out-of-bounds read in uncompressed unci tile range slicing
libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.1, a crafted uncompressed HEIF image using generic zlib unci full-item compression can crash an application that decodes an advertised tile with heifimagehandledecodeimagetile(). In libheif/codecs/uncompressed/uncdecoder.cc, uncdecoder::fetchtiledata() computes a large tile offset and uncdecoder::getcompressedimagedatauncompressed() validates it with rangestartoffset plus rangesize. For the last advertised tile (4095, 4095), the addition can wrap to zero, bypass the bounds check, and pass an invalid source pointer and a one-terabyte length to memcpy. The observed result is an out-of-bounds read and process crash; opening the file alone does not trigger the issue because tile decoding is required. This issue is fixed in version 1.23.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
libheifto a version that resolves this vulnerability.Fixed in 1.23.1
Event History
Frequently Asked Questions
Which deployments are exposed?
Applications using libheif versions from 1.19.0 up to, but not including, 1.23.1 are affected if they decode tiles from untrusted uncompressed HEIF images using generic zlib unci full-item compression. Merely opening or parsing the file does not trigger the issue.
What is required to trigger the crash?
An attacker needs to supply a crafted image that advertises a tile at (4095, 4095) and cause the application to decode that tile through heif_image_handle_decode_image_tile(). The documented observed impact is an out-of-bounds read leading to a process crash.
What can be done if patching is not immediately possible?
Upgrade libheif to version 1.23.1, which fixes the issue. If upgrading cannot happen immediately, avoid decoding tiles from untrusted uncompressed HEIF images that use generic zlib unci full-item compression, particularly attacker-controlled tile requests.