Description
libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, when WITH_UNCOMPRESSED_CODEC is enabled, heif_context_add_image_tile() accepts an independently constructed tile whose component-plane dimensions do not match the tile geometry established by the prototype image. ImageItem_uncompressed::add_image_tile() passes that tile directly to unc_encoder::encode_tile(), which lacked the check_component_sizes() gate and sizes its output from the configured tile geometry while copying the tile's actual component-plane dimensions. An oversized component plane can therefore make unc_encoder_component_interleave::encode_tile() copy attacker-controlled data beyond the heap output buffer. This issue is fixed in version 1.23.2.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| strukturag | libheif | < 1.23.2 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libheif | 1.23.2-1 | — |
| Debian 13 | libheif | 1.23.4-1~deb13u1 | — |
| Debian 12 | libheif | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | libheif | 1.23.4-150700.3.21.1 | SUSE-SU-2026:4276-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | libheif | 1.23.4-1.1 | openSUSE-SU-2026:11719-1 |
| openSUSE Leap 16.0 | libheif | 1.23.4-160000.1.1 | openSUSE-SU-2026:21889-1 |
Advisories 3
- openSUSE-SU-2026:21889-1 Security update for libheif SUSE / openSUSE Security Updates · Sep 25, 2026
- SUSE-SU-2026:4276-1 Security update for libheif SUSE / openSUSE Security Updates · Sep 22, 2026
- openSUSE-SU-2026:11719-1 gdk-pixbuf-loader-libheif-1.23.4-1.1 on GA media SUSE / openSUSE Security Updates · Sep 9, 2026