USN-8649-1: libheif vulnerabilities
It was discovered that libheif had an integer underflow in the Fraction constructor when a clap transform was applied twice. An attacker could possibly use this issue to cause libheif to crash, resulting in a denial of service. (CVE-2026-62289) It was discovered that libheif had an out-of-bounds read in uncompressed tile range slicing. An attacker could possibly use this issue to cause libheif to crash, resulting in a denial of service. This issue only affected Ubuntu 25.10. (CVE-2026-62292)
CSIRTS triage
- What
- Integer underflow in the Fraction constructor and out-of-bounds read in uncompressed tile range slicing cause denial of service through crashes.
- Who is affected
- Systems running libheif; Ubuntu 25.10 is specifically affected by CVE-2026-62292.
- Urgency
- Low to moderate priority; denial of service impacts only, not yet exploited.
- Action
- Apply security updates for libheif when available through package managers.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch libheif
Get an email when a new libheif advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://ubuntu.com/security/notices/USN-8649-1
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-622890.39% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 33% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-622920.54% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 43% of all EPSS-scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-62289 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-62292 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
More from Ubuntu Security Notices
- unknownUSN-8563-4: nginx regression2026-08-19
- unknownUSN-8651-1: curl vulnerability2026-08-19
- unknownUSN-8650-1: Cap'n Proto vulnerabilities2026-08-19
- unknownUSN-8563-3: nginx vulnerability2026-08-19
- unknownUSN-8648-1: Bind vulnerabilities2026-08-19