CVE-2026-84450: libheif: `clap` + oversized `ispe` aborts on an assert in `Fraction::Fraction` (incomplete fix for CVE-2026-62289)
libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.3, a crafted image item containing a clap property and an ispe width or height greater than INT32MAX + 1 can reach crop calculations through heifimagehandlegetimagetiling(). Boxclap::leftrounded() or Boxclap::toprounded() passes the image dimension minus one to Fraction::Fraction(), whose uint32t constructor uses an assertion as input validation, causing assert-enabled builds to abort. Release builds can instead compute invalid crop geometry, and the tiling API returns dimensions that the normal decode security limits reject. This issue is fixed in version 1.23.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
libheifto a version that resolves this vulnerability.Fixed in 1.23.3Patch CVE-2026-62289
Event History
Frequently Asked Questions
Which deployments are most exposed?
Applications using libheif versions 1.19.0 through versions before 1.23.3 are affected when they process crafted HEIF or AVIF content and call heif_image_handle_get_image_tiling(). Assert-enabled builds can abort, while release builds may return invalid crop geometry.
What must an attacker provide to trigger the issue?
The attacker needs a crafted image item with a clap property and an ispe width or height greater than INT32_MAX + 1. The vulnerable crop calculation is reached through the image tiling API.
How can I determine whether my application is affected?
Check whether the bundled or linked libheif version is earlier than 1.23.3 and whether the application exposes heif_image_handle_get_image_tiling() while handling untrusted images. In assert-enabled builds, processing a triggering file can terminate the process through an assertion failure.
What should be done if the application cannot immediately upgrade?
Avoid passing untrusted images to heif_image_handle_get_image_tiling() until libheif can be updated. The issue is fixed in libheif 1.23.3.