CVE-2026-62291

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-62291
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-62291.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-62291
Aliases
  • GHSA-xpw3-9rhw-482x
Downstream
Related
Published
2026-08-18T21:21:32Z
Modified
2026-09-11T08:36:37Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L CVSS Calculator
Summary
libheif: Heap out of bounds write in libheif uncompressed encoder when writing images with mismatched auxiliary alpha dimensions
Details

libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted image sequence with a 2x2 primary plane and a 256x256 auxiliary alpha plane can cause attacker-controlled heap corruption during a normal decode and re-encode workflow. Track_Visual::decode_next_image_sample() calls transfer_channel_from_image_as() without checking that the auxiliary alpha dimensions match the main frame. The resulting inconsistent image reaches heif_track_decode_next_image() and then heif_context_encode_image(). In unc_encoder::encode(), unc_encoder_component_interleave::encode_tile() sizes its buffer with compute_tile_data_size_bytes() using the primary dimensions but copies each component using its actual plane dimensions. The oversized alpha plane is therefore copied beyond the allocation, causing an out-of-bounds write; the inverse size mismatch can also produce an out-of-bounds read. This issue is fixed in version 1.23.1.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-125",
        "CWE-787"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/62xxx/CVE-2026-62291.json"
}
References

Affected packages

Git / github.com/strukturag/libheif

Affected ranges

Type
GIT
Repo
https://github.com/strukturag/libheif
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
ac5521ad50399885de96bb6a0733a5d2442740f9
Fixed
2c4bbb54c2738d4a5efbbe3e5fa1d5d76bb88eb0
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.23.1"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v1.*
v1.1.0
v1.10.0
v1.11.0
v1.12.0
v1.13.0
v1.14.0
v1.14.1
v1.14.2
v1.15.0
v1.15.1
v1.15.2
v1.16.0
v1.16.1
v1.16.2
v1.17.0
v1.17.1
v1.17.2
v1.17.3
v1.17.4
v1.17.5
v1.17.6
v1.18.0
v1.18.0-rc1
v1.19.0
v1.19.1
v1.19.2
v1.19.3
v1.19.4
v1.19.5
v1.2.0
v1.20.0
v1.20.1
v1.21.0
v1.21.1
v1.21.2
v1.22.0
v1.22.1
v1.22.2
v1.23.0
v1.3.0
v1.3.1
v1.3.2
v1.7.0
v1.8.0
v1.9.0
v1.9.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-62291.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "196621563875232672326975017639418466314",
            "length": 1991
        },
        "id": "CVE-2026-62291-2123b5fb",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/strukturag/libheif/commit/ac5521ad50399885de96bb6a0733a5d2442740f9",
        "target": {
            "file": "libheif/codecs/uncompressed/unc_encoder.cc",
            "function": "unc_encoder::encode"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "293395063892101953258080744798451347796",
                "200297442726296910814761521898004405792",
                "258223894114559044881824964583410561485"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-62291-3833fea8",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/strukturag/libheif/commit/ac5521ad50399885de96bb6a0733a5d2442740f9",
        "target": {
            "file": "libheif/codecs/uncompressed/unc_encoder.h"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "34033797850869162351072586973842857089",
                "79161378973817674341721236884539057353",
                "184479302279232768650820080103922531901",
                "317675565127953322536838477041370862769",
                "23374754115428411822086913696571082841",
                "254957459140435460146804778449576390210"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-62291-743d4de7",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/strukturag/libheif/commit/ac5521ad50399885de96bb6a0733a5d2442740f9",
        "target": {
            "file": "libheif/codecs/uncompressed/unc_encoder.cc"
        }
    }
]
vanir_signatures_modified 
"2026-09-11T08:36:37Z"