HEIF/AVIF File Format Decoder Vulnerability in libheif by strukturag

CVE-2026-62289

What is CVE-2026-62289?

A flaw in libheif, a decoding and encoding library for HEIF and AVIF file formats, allows a crafted HEIF or AVIF file to trigger an image dimension reduction to zero. This occurs when calling the function heif_image_handle_get_image_tiling, leading to application crashes or corrupt image processing outcomes. Specifically, the image_width parameter underflows due to inappropriate calculations, which can cause debug builds to assert and abort while release builds may produce a corrupt crop with zero-width tiling results. This vulnerability is resolved in libheif version 1.23.1.

References