Description
libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.1, a crafted uncompressed HEIF image using generic zlib unci full-item compression can crash an application that decodes an advertised tile with heif_image_handle_decode_image_tile(). In libheif/codecs/uncompressed/unc_decoder.cc, unc_decoder::fetch_tile_data() computes a large tile offset and unc_decoder::get_compressed_image_data_uncompressed() validates it with range_start_offset plus range_size. For the last advertised tile (4095, 4095), the addition can wrap to zero, bypass the bounds check, and pass an invalid source pointer and a one-terabyte length to memcpy. The observed result is an out-of-bounds read and process crash; opening the file alone does not trigger the issue because tile decoding is required. This issue is fixed in version 1.23.1.
Published: 2026-08-18
Score: 8.7 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A crafted uncompressed HEIF image can trigger an out‑of‑bounds read when the libheif function heif_image_handle_decode_image_tile is called. The bug occurs in unc_decoder::fetch_tile_data on the last advertised tile (4095, 4095) when the offset calculation wraps to zero, bypassing bounds checking and allowing a memcpy of an invalid pointer with an 1‑terabyte length. This results in a process crash and is identified as a CWE‑125 overflow.

Affected Systems

The vulnerability affects the libheif library distributed by strukturag. Versions from 1.19.0 through 1.23.1 are affected; the fix is included in 1.23.1 onward.

Risk and Exploitability

The CVSS score of 8.7 indicates high severity. No EPSS score is available and the issue is not listed in the CISA KEV catalog. Exploitation requires an attacker to supply a malicious HEIF file to an application that decodes the final tile, typically via heif_image_handle_decode_image_tile. Because the fault only causes a crash, the main risk is denial of service rather than code execution, but it can impact services that rely on HEIF processing.

Generated by OpenCVE AI on August 19, 2026 at 00:23 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade libheif to version 1.23.1 or later.
  • Rebuild affected applications to link against the updated libheif.
  • If an upgrade is not immediately feasible, block or sanitize incoming HEIF files and disable processing of uncompressed HEIF images that use generic zlib unci full‑item compression.
  • Monitor application logs for unexpected crashes after updating the library.

Generated by OpenCVE AI on August 19, 2026 at 00:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6417-1 libheif security update
History

Tue, 18 Aug 2026 21:30:00 +0000

Type Values Removed Values Added
Description libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.1, a crafted uncompressed HEIF image using generic zlib unci full-item compression can crash an application that decodes an advertised tile with heif_image_handle_decode_image_tile(). In libheif/codecs/uncompressed/unc_decoder.cc, unc_decoder::fetch_tile_data() computes a large tile offset and unc_decoder::get_compressed_image_data_uncompressed() validates it with range_start_offset plus range_size. For the last advertised tile (4095, 4095), the addition can wrap to zero, bypass the bounds check, and pass an invalid source pointer and a one-terabyte length to memcpy. The observed result is an out-of-bounds read and process crash; opening the file alone does not trigger the issue because tile decoding is required. This issue is fixed in version 1.23.1.
Title libheif: Out-of-bounds read in uncompressed unci tile range slicing
Weaknesses CWE-125
References
Metrics cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-18T21:20:24.933Z

Reserved: 2026-07-13T18:37:08.488Z

Link: CVE-2026-62292

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-18T22:17:03.023

Modified: 2026-08-18T22:17:03.023

Link: CVE-2026-62292

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-19T00:30:04Z

Weaknesses