Skip to content
OpenAdvisories
Medium · 4.3 CVE-2026-62289 EUVD-2026-62188

libheif: Integer underflow in Fraction constructor via double clap transform application

Published Aug 18, 2026 · Updated Aug 19, 2026 · Assigned by GitHub_M

Description

libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF or AVIF file containing a clean aperture box can reduce an image dimension to zero and crash or corrupt tiling results when heif_image_handle_get_image_tiling(handle, 1, &tiling) is called. ImageItem::get_heif_image_tiling() returns already transformed dimensions, and process_image_transformations_on_tiling() applies the clean aperture transformation again. The second application passes zero to Box_clap::left_rounded(0), where image_width minus one underflows and constructs Fraction(0xFFFFFFFF, 2). Debug builds reach an assertion and abort, while release builds can return a corrupt crop and zero-width tiling result. The affected implementation spans libheif/image-items/image_item.cc, libheif/context.cc, and libheif/box.cc. This issue is fixed in version 1.23.1.

Affected products

VendorProductAffectedFixed
strukturag libheif < 1.23.1 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 libheif 1.23.1-1 —
Debian 13 libheif 1.19.8-1+deb13u1 —
Debian 12 libheif No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.04 LTS libheif 1.21.2-3ubuntu0.4 —
Ubuntu 24.04 LTS libheif 1.17.6-1ubuntu4.7 USN-8683-1
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 22.04 LTS libheif 1.12.0-2ubuntu0.1~esm4 USN-8683-1
Ubuntu Pro 20.04 LTS libheif 1.6.1-1ubuntu0.1~esm4 USN-8683-1
Ubuntu Pro 18.04 LTS libheif 1.1.0-2ubuntu0.1~esm4 USN-8683-1
ReleasePackageFixed inAdvisory
SLES 15 SP7 libheif 1.23.1-150700.3.18.1 SUSE-SU-2026:3597-1
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 libheif 1.23.1-160000.1.1 SUSE-SU-2026:23320-1
SLES 16.0 libheif 1.23.1-160000.1.1 SUSE-SU-2026:23320-1
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed libheif 1.23.1-1.1 openSUSE-SU-2026:11416-1
openSUSE Leap 16.0 libheif 1.23.1-160000.1.1 openSUSE-SU-2026:21644-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 libheif +3 1.19.8-1.amzn2023.0.8 ALAS2023-2026-2134

Advisories 6

References