CVE-2026-62289

Name of the Vulnerable Software and Affected Versions libheif versions prior to 1.23.1

Description A flaw exists in the HEIF and AVIF file format decoder and encoder where a specially crafted file containing a clean aperture box can cause an image dimension to be reduced to zero. This occurs when the heif image handle get image tiling(handle, 1, &tiling) function is called. The issue stems from ImageItem::get heif image tiling() returning already transformed dimensions, which are then processed again by process image transformations on tiling(). This second application leads to an underflow in Box clap::left rounded(0), where image width minus one results in a Fraction(0xFFFFFFFF, 2). Consequently, debug builds may abort due to an assertion, while release builds may return a corrupt crop and a zero-width tiling result. The affected implementation is located in libheif/image-items/image item.cc, libheif/context.cc, and libheif/box.cc.

Recommendations Update to version 1.23.1.