CVE-2026-62292

Name of the Vulnerable Software and Affected Versions libheif versions 1.19.0 through 1.23.0

Description A flaw exists in the way uncompressed HEIF images using generic zlib unci full-item compression are handled. When an application decodes an advertised tile using the heif image handle decode image tile() function, a crafted image can cause a process crash. Specifically, in libheif/codecs/uncompressed/unc decoder.cc, the unc decoder::fetch tile data() function computes a large tile offset, and unc decoder::get compressed image data uncompressed() validates it. For the last advertised tile, an integer wrap-around can occur during the addition of range start offset and range size, bypassing bounds checks and passing an invalid source pointer with a one-terabyte length to memcpy(). This results in an out-of-bounds read, which is a read operation that accesses memory outside the intended buffer.

Recommendations Update to version 1.23.1.