CVE-2026-62292: libheif: Out-of-bounds read in uncompressed unci tile range slicing

Published Aug 18, 2026
·
Updated

libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.1, a crafted uncompressed HEIF image using generic zlib unci full-item compression can crash an application that decodes an advertised tile with heifimagehandledecodeimagetile(). In libheif/codecs/uncompressed/uncdecoder.cc, uncdecoder::fetchtiledata() computes a large tile offset and uncdecoder::getcompressedimagedatauncompressed() validates it with rangestartoffset plus rangesize. For the last advertised tile (4095, 4095), the addition can wrap to zero, bypass the bounds check, and pass an invalid source pointer and a one-terabyte length to memcpy. The observed result is an out-of-bounds read and process crash; opening the file alone does not trigger the issue because tile decoding is required. This issue is fixed in version 1.23.1.

Affected Software

1 affected component
libheif libheif>1.19.0<=1.23.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade libheif to a version that resolves this vulnerability.

    Fixed in 1.23.1

Event History

Aug 18, 2026
CVE Published
via MITRE·09:20 PM
Data Sourced
via MITRE·09:20 PM
DescriptionWeakness

Frequently Asked Questions

1

Which deployments are exposed?

Applications using libheif versions from 1.19.0 up to, but not including, 1.23.1 are affected if they decode tiles from untrusted uncompressed HEIF images using generic zlib unci full-item compression. Merely opening or parsing the file does not trigger the issue.

2

What is required to trigger the crash?

An attacker needs to supply a crafted image that advertises a tile at (4095, 4095) and cause the application to decode that tile through heif_image_handle_decode_image_tile(). The documented observed impact is an out-of-bounds read leading to a process crash.

3

What can be done if patching is not immediately possible?

Upgrade libheif to version 1.23.1, which fixes the issue. If upgrading cannot happen immediately, avoid decoding tiles from untrusted uncompressed HEIF images that use generic zlib unci full-item compression, particularly attacker-controlled tile requests.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203