Heap Buffer Overflow Vulnerability in libheif Library by strukturag
CVE-2026-120208

7.7HIGH

Key Information:

Vendor

Strukturag

Status
Libheif
Vendor
CVE Published:
31 October 2026

What is CVE-2026-120208?

The libheif library versions 1.18.0 through 1.23.2 are susceptible to a heap-based buffer overflow due to improper handling of chroma components with differing bit depths in the unc_decoder_mixed_interleave::processTile() function. Attackers may exploit this vulnerability by crafting specially designed HEIF files, specifying uneven bit depths for components like Cb and Cr, which can result in out-of-bounds writes. This could lead to unauthorized code execution in environments relying on the affected image-processing pipelines.

Affected Version(s)

libheif 1.18.0 < 1.23.3

References

https://github.com/strukturag/libheif/security/advisories...
vendor-advisory
https://github.com/strukturag/libheif/commit/9d3cd91d7b1c...
patch
https://github.com/strukturag/libheif/releases/tag/v1.23.3
release-notes

CVSS V4

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Alex Thomas (Wordfence)
poppo25
Wordfence Argus
.