CVE-2026-62292
libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.1, a crafted uncompressed HEIF image using generic zlib unci full-item compression can crash an application that decodes an advertised tile with heif_image_handle_decode_image_tile(). In libheif/codecs/uncompressed/unc_decoder.cc, unc_decoder::fetch_tile_data() computes a large tile offset and unc_decoder::get_compressed_image_data_uncompressed() validates it with range_start_offset plus range_size. For the last advertised tile (4095, 4095), the addition can wrap to zero, bypass the bounds check, and pass an invalid source pointer and a one-terabyte length to memcpy. The observed result is an out-of-bounds read and process crash; opening the file alone does not trigger the issue because tile decoding is required. This issue is fixed in version 1.23.1.
CSIRTS triage
- What
- Integer underflow in the Fraction constructor and out-of-bounds read in uncompressed tile range slicing cause denial of service through crashes.
- Who is affected
- Systems running libheif; Ubuntu 25.10 is specifically affected by CVE-2026-62292.
- Urgency
- Low to moderate priority; denial of service impacts only, not yet exploited.
- Action
- Apply security updates for libheif when available through package managers.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch CVE-2026-62292
Get an email if CVE-2026-62292 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Low exploitation risk0.54% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 43% of all EPSS-scored CVEs.
Advisory coverage (2)
- unknownUSN-8649-1: libheif vulnerabilitiesubuntu · 2026-08-19
- unknownCVE-2026-62292: libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.1, a crafte…nvd · 2026-08-18
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-62292)