CVE-2026-62289

libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF or AVIF file containing a clean aperture box can reduce an image dimension to zero and crash or corrupt tiling results when heif_image_handle_get_image_tiling(handle, 1, &tiling) is called. ImageItem::get_heif_image_tiling() returns already transformed dimensions, and process_image_transformations_on_tiling() applies the clean aperture transformation again. The second application passes zero to Box_clap::left_rounded(0), where image_width minus one underflows and constructs Fraction(0xFFFFFFFF, 2). Debug builds reach an assertion and abort, while release builds can return a corrupt crop and zero-width tiling result. The affected implementation spans libheif/image-items/image_item.cc, libheif/context.cc, and libheif/box.cc. This issue is fixed in version 1.23.1.

• CWE-191
• CWE-617

• https://github.com/strukturag/libheif/commit/f01870c1d7323a3003796d58eba7fff502be994c
• https://github.com/strukturag/libheif/releases/tag/v1.23.1
• https://github.com/strukturag/libheif/security/advisories/GHSA-jc8f-p23p-5hjg

Published

Aug 18, 2026

Last Modified

Sep 9, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-6228The Frontend Admin by DynamiApps plugin for WordPress is vul…8.8
• CVE-2026-62280Open Access Management (OpenAM) is an access management solu…6.1
• CVE-2026-62282OpenCVE is a vulnerability intelligence platform. Prior to 3…6.5
• CVE-2026-62283Nezha Monitoring is a self-hostable, lightweight, servers an…9.9
• CVE-2026-62286Dozzle is a realtime log viewer for docker containers. Prior…4.3
• CVE-2026-62287Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-6229The Royal Elementor Addons plugin for WordPress is vulnerabl…7.2
• CVE-2026-62290cert-manager adds certificates and certificate issuers as re…7.3
• CVE-2026-62291libheif is a HEIF and AVIF file format decoder and encoder. …5.3
• CVE-2026-62292libheif is a HEIF and AVIF file format decoder and encoder. …8.7
• CVE-2026-62293HAPI FHIR is a complete implementation of the HL7 FHIR stand…5
• CVE-2026-62294Flameshot is powerful yet simple to use screenshot software.…5.1