CVE-2026-62289
- Source
- https://cve.org/CVERecord?id=CVE-2026-62289
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-62289.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-62289
- Aliases
-
- GHSA-jc8f-p23p-5hjg
- Downstream
- Related
- Published
- 2026-08-18T21:19:18Z
- Modified
- 2026-09-11T08:36:37Z
- Severity
-
- 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVSS Calculator
- Summary
- libheif: Integer underflow in Fraction constructor via double clap transform application
- Details
-
libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF or AVIF file containing a clean aperture box can reduce an image dimension to zero and crash or corrupt tiling results when heif_image_handle_get_image_tiling(handle, 1, &tiling) is called. ImageItem::get_heif_image_tiling() returns already transformed dimensions, and process_image_transformations_on_tiling() applies the clean aperture transformation again. The second application passes zero to Box_clap::left_rounded(0), where image_width minus one underflows and constructs Fraction(0xFFFFFFFF, 2). Debug builds reach an assertion and abort, while release builds can return a corrupt crop and zero-width tiling result. The affected implementation spans libheif/image-items/image_item.cc, libheif/context.cc, and libheif/box.cc. This issue is fixed in version 1.23.1.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-191", "CWE-617" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/62xxx/CVE-2026-62289.json" }- References
-
- https://github.com/strukturag/libheif/releases/tag/v1.23.1
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/62xxx/CVE-2026-62289.json
- https://github.com/strukturag/libheif/security/advisories/GHSA-jc8f-p23p-5hjg
- https://nvd.nist.gov/vuln/detail/CVE-2026-62289
- https://github.com/strukturag/libheif/commit/f01870c1d7323a3003796d58eba7fff502be994c
Affected packages
Git / github.com/strukturag/libheif
Affected versions
v1.*
v1.1.0
v1.10.0
v1.11.0
v1.12.0
v1.13.0
v1.14.0
v1.14.1
v1.14.2
v1.15.0
v1.15.1
v1.15.2
v1.16.0
v1.16.1
v1.16.2
v1.17.0
v1.17.1
v1.17.2
v1.17.3
v1.17.4
v1.17.5
v1.17.6
v1.18.0
v1.18.0-rc1
v1.19.0
v1.19.1
v1.19.2
v1.19.3
v1.19.4
v1.19.5
v1.2.0
v1.20.0
v1.20.1
v1.21.0
v1.21.1
v1.21.2
v1.22.0
v1.22.1
v1.22.2
v1.23.0
v1.3.0
v1.3.1
v1.3.2
v1.7.0
v1.8.0
v1.9.0
v1.9.1
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-62289.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"function_hash": "127395858670301136793486932149164215610",
"length": 203
},
"id": "CVE-2026-62289-24e6237a",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/strukturag/libheif/commit/f01870c1d7323a3003796d58eba7fff502be994c",
"target": {
"file": "libheif/box.cc",
"function": "Box_clap::left_rounded"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "114392436950431329979051880312602366929",
"length": 15468
},
"id": "CVE-2026-62289-31ac4bc0",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/strukturag/libheif/commit/f01870c1d7323a3003796d58eba7fff502be994c",
"target": {
"file": "libheif/context.cc",
"function": "HeifContext::interpret_heif_file_images"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"323137328082080423087660734327662310503",
"142063287348413789891995274982555633684",
"142571581072056934259932552695967204293",
"43439385830876584403406454163854039821",
"178638664231262657432982186554564778623"
],
"threshold": 0.9
},
"id": "CVE-2026-62289-35df27eb",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/strukturag/libheif/commit/f01870c1d7323a3003796d58eba7fff502be994c",
"target": {
"file": "libheif/context.cc"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "14870450222820045138379254956867175695",
"length": 457
},
"id": "CVE-2026-62289-591b8086",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/strukturag/libheif/commit/f01870c1d7323a3003796d58eba7fff502be994c",
"target": {
"file": "libheif/image-items/image_item.cc",
"function": "ImageItem::get_heif_image_tiling"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"145229682300652585693118782209069082827",
"246830369201480860511003618966674959012",
"196553166530461776274663321217308631989",
"153861403205681785078860704978557782588",
"117124018368679202158853638335122164343",
"238335099759576789963087641100063220601",
"249906638590473267056020913689320663395"
],
"threshold": 0.9
},
"id": "CVE-2026-62289-89fcbcf6",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/strukturag/libheif/commit/f01870c1d7323a3003796d58eba7fff502be994c",
"target": {
"file": "libheif/image-items/image_item.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"260764375588819844769527973480645765516",
"99205648630810848018493836356580996209",
"291359666675066191902089483814190532795",
"151586271326732800389454718483207821948",
"214878245413007012147699939055865952766",
"334665012623755607457861870566110857900",
"133499985991179005616896380677891227346"
],
"threshold": 0.9
},
"id": "CVE-2026-62289-d49f3fdf",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/strukturag/libheif/commit/f01870c1d7323a3003796d58eba7fff502be994c",
"target": {
"file": "libheif/box.cc"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "271452116196700294234942391421722297466",
"length": 196
},
"id": "CVE-2026-62289-ed26f71a",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/strukturag/libheif/commit/f01870c1d7323a3003796d58eba7fff502be994c",
"target": {
"file": "libheif/box.cc",
"function": "Box_clap::top_rounded"
}
}
]
vanir_signatures_modified
"2026-09-11T08:36:37Z"