CVE-2026-62292: libheif Buffer Overflow Vulnerability

CVE-2026-62292 Overview

CVE-2026-62292 is an integer overflow vulnerability in libheif, an open-source HEIF and AVIF file format decoder and encoder. The flaw affects versions from 1.19.0 up to but not including 1.23.1. A crafted uncompressed HEIF image using generic zlib unci full-item compression can crash any application that decodes an advertised tile through heif_image_handle_decode_image_tile(). The integer overflow bypasses a bounds check and passes an invalid source pointer with a one-terabyte length to memcpy, resulting in an out-of-bounds read [CWE-125] and process termination.

Critical Impact
A crafted HEIF file triggers an out-of-bounds read and crashes the host application when a tile is decoded, enabling remote denial-of-service against image processing pipelines.

Affected Products

libheif versions 1.19.0 through 1.23.0
Applications and libraries embedding vulnerable libheif builds
Image processing pipelines invoking heif_image_handle_decode_image_tile()

Discovery Timeline

2026-08-18 - CVE-2026-62292 published to NVD
2026-08-18 - Last updated in NVD database
Fixed in libheif - Version 1.23.1 released with the patch

Technical Details for CVE-2026-62292

Vulnerability Analysis

The defect lives in libheif/codecs/uncompressed/unc_decoder.cc. The function unc_decoder::fetch_tile_data() computes a large tile offset for the advertised tile coordinates. The function unc_decoder::get_compressed_image_data_uncompressed() then validates this offset with the expression range_start_offset + range_size. For the last advertised tile at coordinates (4095, 4095), this unchecked addition wraps around to zero on typical integer widths.

The wrapped value passes the bounds check silently. The decoder then hands memcpy an invalid source pointer paired with a length approaching one terabyte. The process reads far outside allocated memory and crashes. Opening the file alone does not trigger the issue because tile decoding must be explicitly invoked.

Root Cause

The root cause is an unchecked additive integer overflow in a range validation expression. The code trusts attacker-controlled tile coordinates to produce a sane sum. When the two operands together exceed the integer type maximum, the result wraps and the guard clause returns success.

Attack Vector

An attacker delivers a crafted unci HEIF image through any channel that leads to tile decoding: web upload handlers, messaging clients, thumbnail generators, or gallery applications. No authentication is required. User interaction is limited to triggering a decode operation on the file.

text

// Patch diff from libheif/codecs/uncompressed/unc_decoder.cc
       data->insert(data->end(), uncompressed_unit_data.data(), uncompressed_unit_data.data() + uncompressed_unit_data.size());
     }
 
-    if (range_start_offset + range_size > data->size()) {
+    if (range_start_offset > data->size() ||
+        range_size > data->size() - range_start_offset) {
       return {
         heif_error_Invalid_input,
         heif_suberror_Unspecified,

Source: libheif commit 089a809. The patch replaces the vulnerable additive check with two subtractive checks that cannot overflow.

Detection Methods for CVE-2026-62292

Indicators of Compromise

Unexpected crashes or segmentation faults in processes that decode HEIF or AVIF content
HEIF files declaring unci (uncompressed) items with advertised tile grids reaching (4095, 4095)
Repeated abnormal termination of thumbnail services, image converters, or gallery daemons after handling user-supplied images

Detection Strategies

Inventory linked libheif versions across endpoints and servers; flag any build between 1.19.0 and 1.23.0
Parse suspect HEIF files with a hardened tool to inspect the unci box and verify tile count sanity before production decode
Correlate application crash telemetry with recent HEIF file ingestion events in SIEM data

Monitoring Recommendations

Alert on repeated crashes of image-handling processes such as browser sandboxes, mail preview services, and media indexers
Monitor upload endpoints for HEIF files that fail integrity validation or trigger downstream decode failures
Track package inventory changes for libheif across Linux distributions and container base images

How to Mitigate CVE-2026-62292

Immediate Actions Required

Upgrade libheif to version 1.23.1 or later on all systems
Rebuild and redeploy any statically linked applications that bundle libheif
Disable HEIF decoding in exposed services until patches are applied where feasible

Patch Information

The fix is available in libheif 1.23.1. The patched code validates range_start_offset and range_size independently against data->size(), avoiding the additive overflow. Review the GitHub Security Advisory GHSA-73p7-m7gg-w2jv and the libheif v1.23.1 release notes for full details.

Workarounds

Block or quarantine HEIF and AVIF uploads at the perimeter until the library is upgraded
Run image decoders inside sandboxed processes with resource limits and automatic restart
Restrict tile decoding APIs to trusted content sources when a full upgrade is not immediately possible

bash

# Verify installed libheif version on Linux
dpkg -l | grep libheif
rpm -qa | grep libheif

# Build and install the patched release from source
git clone --branch v1.23.1 https://github.com/strukturag/libheif.git
cd libheif && mkdir build && cd build
cmake --preset=release ..
make -j$(nproc) && sudo make install
sudo ldconfig