CVE-2026-62291

libheif, a widely used open-source HEIF/AVIF decoder and encoder, fails to validate that an auxiliary alpha plane's dimensions match the main frame when decoding image sequences: Track_Visual::decode_next_image_sample() passes an inconsistent image downstream, and during re-encoding unc_encoder_component_interleave::encode_tile() allocates its buffer using the primary dimensions while copying each component using its actual plane dimensions, causing an attacker-controlled heap out-of-bounds write (and, with the inverse mismatch, an out-of-bounds read). The flaw is triggered by decoding a crafted image sequence (a 2x2 primary plane with a 256x256 alpha plane is a demonstrated trigger) in a normal decode-and-re-encode workflow, so an attacker gains heap corruption that can crash the application (DoS) and potentially enable memory-corruption exploitation with limited confidentiality, integrity, and availability impact per the CVSS scoring. Any application or system that decodes untrusted HEIF/AVIF image sequences with libheif 1.23.0 or earlier is affected, including Linux distributions that ship the library, as confirmed by Ubuntu security notice USN-8774-1. No public proof-of-concept is known, the flaw is not in CISA KEV, and EPSS estimates only a 0.1% probability of exploitation within 30 days, so no exploitation is currently known.

What to do: Upgrade libheif to version 1.23.1, or apply the distro update provided in Ubuntu USN-8774-1 (and equivalent updates in other distributions that package libheif). Until patched, avoid processing untrusted HEIF/AVIF image sequences in tools that decode and re-encode/transcode images with libheif (viewers, thumbnailers, transcoders, ImageMagick/vips-style pipelines that link it). Inventory systems and applications for linked libheif builds to confirm they receive the fixed version.