strukturag libheif up to 1.23.0 Uncompressed Codec unc_decoder.cc fetch_tile_data out-of-bounds

Summaryinfo

A vulnerability was found in strukturag libheif up to 1.23.0. It has been rated as critical. This impacts the function unc_decoder::fetch_tile_data of the file libheif/codecs/uncompressed/unc_decoder.cc of the component Uncompressed Codec. Performing a manipulation results in out-of-bounds. This vulnerability is cataloged as CVE-2026-62292. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability classified as critical has been found in strukturag libheif up to 1.23.0. This affects the function unc_decoder::fetch_tile_data of the file libheif/codecs/uncompressed/unc_decoder.cc of the component Uncompressed Codec. The manipulation with an unknown input leads to a out-of-bounds vulnerability. CWE is classifying the issue as CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.1, a crafted uncompressed HEIF image using generic zlib unci full-item compression can crash an application that decodes an advertised tile with heif_image_handle_decode_image_tile(). In libheif/codecs/uncompressed/unc_decoder.cc, unc_decoder::fetch_tile_data() computes a large tile offset and unc_decoder::get_compressed_image_data_uncompressed() validates it with range_start_offset plus range_size. For the last advertised tile (4095, 4095), the addition can wrap to zero, bypass the bounds check, and pass an invalid source pointer and a one-terabyte length to memcpy. The observed result is an out-of-bounds read and process crash; opening the file alone does not trigger the issue because tile decoding is required. This issue is fixed in version 1.23.1.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-62292 since 07/13/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available.

Upgrading to version 1.23.1 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• strukturag

Name

• libheif

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14
• 1.15
• 1.16
• 1.17
• 1.18
• 1.19
• 1.20
• 1.21
• 1.22
• 1.23.0

Website

• Product: https://github.com/strukturag/libheif/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion