---
id: CVE-2026-62291
title: libheif is a HEIF and AVIF file format decoder and encoder
summary: >-
  libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and
  earlier, a crafted image sequence with a 2x2 primary plane and a 256x256
  auxiliary alpha plane can cause attacker-controlled heap corruption during a
  normal decode…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L'
cwe:
  - CWE-125
  - CWE-787
published: '2026-08-18'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T21:13:25.910'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-62291'
references:
  - url: >-
      https://github.com/strukturag/libheif/commit/ac5521ad50399885de96bb6a0733a5d2442740f9
    label: security-advisories@github.com
  - url: 'https://github.com/strukturag/libheif/releases/tag/v1.23.1'
    label: security-advisories@github.com
  - url: >-
      https://github.com/strukturag/libheif/security/advisories/GHSA-xpw3-9rhw-482x
    label: security-advisories@github.com
  - url: >-
      https://github.com/strukturag/libheif/security/advisories/GHSA-xpw3-9rhw-482x
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.00164
epssPercentile: 0.05031
ingestedAt: '2026-09-09T21:22:45.538Z'
---

## Overview

libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted image sequence with a 2x2 primary plane and a 256x256 auxiliary alpha plane can cause attacker-controlled heap corruption during a normal decode and re-encode workflow. Track_Visual::decode_next_image_sample() calls transfer_channel_from_image_as() without checking that the auxiliary alpha dimensions match the main frame. The resulting inconsistent image reaches heif_track_decode_next_image() and then heif_context_encode_image(). In unc_encoder::encode(), unc_encoder_component_interleave::encode_tile() sizes its buffer with compute_tile_data_size_bytes() using the primary dimensions but copies each component using its actual plane dimensions. The oversized alpha plane is therefore copied beyond the allocation, causing an out-of-bounds write; the inverse size mismatch can also produce an out-of-bounds read. This issue is fixed in version 1.23.1.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.