CVE-2026-62289
libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF or AVIF file containing a clean aperture box can reduce an image dimension to zero and crash or corrupt tiling results when heif_image_handle_get_image_tiling(handle, 1, &tiling) is called. ImageItem::get_heif_image_tiling() returns already transformed dimensions, and process_image_transformations_on_tiling() applies the clean aperture transformation again. The second application passes zero to Box_clap::left_rounded(0), where image_width minus one underflows and constructs Fraction(0xFFFFFFFF, 2). Debug builds reach an assertion and abort, while release builds can return a corrupt crop and zero-width tiling result. The affected implementation spans libheif/image-items/image_item.cc, libheif/context.cc, and libheif/box.cc. This issue is fixed in version 1.23.1.
CSIRTS triage
- What
- Integer underflow in the Fraction constructor and out-of-bounds read in uncompressed tile range slicing cause denial of service through crashes.
- Who is affected
- Systems running libheif; Ubuntu 25.10 is specifically affected by CVE-2026-62292.
- Urgency
- Low to moderate priority; denial of service impacts only, not yet exploited.
- Action
- Apply security updates for libheif when available through package managers.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch CVE-2026-62289
Get an email if CVE-2026-62289 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Low exploitation risk0.39% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 33% of all EPSS-scored CVEs.
Advisory coverage (2)
- unknownUSN-8649-1: libheif vulnerabilitiesubuntu · 2026-08-19
- mediumCVE-2026-62289: libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted H…nvd · 2026-08-18
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-62289)