CVE-2026-62291

Name of the Vulnerable Software and Affected Versions libheif versions prior to 1.23.1

Description An issue exists in the uncompressed encoder where a crafted image sequence with mismatched dimensions between the primary plane and the auxiliary alpha plane can lead to heap corruption during a decode and re-encode workflow. Specifically, the function Track Visual::decode next image sample() calls transfer channel from image as() without verifying that the auxiliary alpha dimensions match the main frame. This inconsistency propagates through heif track decode next image() to heif context encode image(). Within unc encoder::encode(), the function unc encoder component interleave::encode tile() calculates the buffer size using compute tile data size bytes() based on primary dimensions but copies components using their actual plane dimensions. This results in an out-of-bounds write when the alpha plane is oversized, and can potentially cause an out-of-bounds read if the size mismatch is inverted.

Recommendations Update libheif to version 1.23.1.