SB2026081955 - SUSE update for libheif
Published: August 19, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 vulnerabilities.
1) Integer underflow (CVE-ID: CVE-2026-62289)
CWE-ID: CWE-191 - Integer underflow
CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to integer underflow in the Fraction constructor when processing a crafted HEIF/AVIF file through the tiling API with process_image_transformations=1. A remote attacker can supply a specially crafted file to cause a denial of service.
User interaction is required to open the crafted file, or the issue can be triggered server-side when uploaded content is processed automatically.
2) Out-of-bounds write (CVE-ID: CVE-2026-62291)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause memory corruption.
The vulnerability exists due to out-of-bounds write in unc_encoder_component_interleave::encode_tile when re-encoding a decoded image with mismatched primary and auxiliary alpha plane dimensions. A remote attacker can trick the victim into opening a specially crafted HEIF sequence file and re-encoding the decoded frame to cause memory corruption.
User interaction is required to open a crafted file, and exploitation occurs through a decode and re-encode workflow using the public APIs.
3) Out-of-bounds read (CVE-ID: CVE-2026-62292)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to out-of-bounds read in unc_decoder::get_compressed_image_data_uncompressed() when decoding an advertised image tile from a crafted HEIF uncompressed image through heif_image_handle_decode_image_tile(). A remote attacker can supply a specially crafted HEIF file and trigger tile decoding to cause a denial of service.
The issue is not triggered by merely opening the file; the vulnerable path is reached when an application enumerates tiling metadata and decodes an advertised tile.
4) Reachable assertion (CVE-ID: CVE-2026-62377)
CWE-ID: CWE-617 - Reachable Assertion
CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to reachable assertion in HeifContext::get_track() when processing a crafted HEIF sequence file that is accepted with no registered sequence tracks. A remote attacker can trick the victim into opening a crafted file to cause a denial of service.
User interaction is required to open or process the crafted HEIF file. In builds with assertions disabled, the issue may instead lead to undefined behavior due to dereferencing an empty track map.
Remediation
Install update from vendor's website.