Integer underflow in libheif - CVE-2026-62289

Vulnerability identifier: #VU135515

CSH Severity: Low

CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-62289

CWE-ID: CWE-191

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to integer underflow in the Fraction constructor when processing a crafted HEIF/AVIF file through the tiling API with process_image_transformations=1. A remote attacker can supply a specially crafted file to cause a denial of service.

User interaction is required to open the crafted file, or the issue can be triggered server-side when uploaded content is processed automatically.

libheif
Debian Linux
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
Fedora
Desktop Applications Module
SUSE Package Hub 15
openSUSE Leap
Ubuntu
libheif-dev (Ubuntu package)
libheif1 (Ubuntu package)
heif-gdk-pixbuf (Ubuntu package)
heif-thumbnailer (Ubuntu package)
libheif-plugin-rav1e (Ubuntu package)
libheif-plugin-x265 (Ubuntu package)
libheif-plugin-libde265 (Ubuntu package)
libheif-plugin-aomdec (Ubuntu package)
libheif-plugin-dav1d (Ubuntu package)
libheif-plugin-aomenc (Ubuntu package)
libheif-plugin-svtenc (Ubuntu package)
libheif-plugin-ffmpegdec (Ubuntu package)
libheif-plugin-jpegenc (Ubuntu package)
libheif-plugin-j2kdec (Ubuntu package)
libheif-plugin-jpegdec (Ubuntu package)
libheif-plugin-j2kenc (Ubuntu package)
libheif-plugins-all (Ubuntu package)
libheif-plugin-kvazaar (Ubuntu package)
heif-view (Ubuntu package)
xeve
xevd
openjph
libheif1-64bit
libheif1-64bit-debuginfo
libheif1-32bit
libheif1-32bit-debuginfo
gdk-pixbuf-loader-libheif
libheif-devel
libheif1-debuginfo
libheif-debugsource
libheif1
gdk-pixbuf-loader-libheif-debuginfo
libheif-ffmpeg
libheif-rav1e-debuginfo
libheif-dav1d
libheif-rav1e
libheif-aom-debuginfo
libheif-jpeg-debuginfo
libheif-jpeg
libheif-aom
libheif-dav1d-debuginfo
libheif-ffmpeg-debuginfo
libheif
OpenImageIO
mingw-openexr
aom
ffmpeg
libheif (Debian package)

Install security update from vendor's website.

libheif - update to 1.23.1
libheif-dev (Ubuntu package) - addressed in versions 1.1.0-2ubuntu0.1~esm4, 1.6.1-1ubuntu0.1~esm4, 1.12.0-2ubuntu0.1~esm4
libheif1 (Ubuntu package) - addressed in versions 1.1.0-2ubuntu0.1~esm4, 1.6.1-1ubuntu0.1~esm4, 1.12.0-2ubuntu0.1~esm4, 1.17.6-1ubuntu4.7, 1.21.2-3ubuntu0.4
heif-gdk-pixbuf (Ubuntu package) - addressed in versions 1.6.1-1ubuntu0.1~esm4, 1.12.0-2ubuntu0.1~esm4, 1.17.6-1ubuntu4.7, 1.21.2-3ubuntu0.4
heif-thumbnailer (Ubuntu package) - addressed in versions 1.6.1-1ubuntu0.1~esm4, 1.12.0-2ubuntu0.1~esm4, 1.17.6-1ubuntu4.7, 1.21.2-3ubuntu0.4
libheif-plugin-rav1e (Ubuntu package) - addressed in versions 1.17.6-1ubuntu4.7, 1.21.2-3ubuntu0.4
libheif-plugin-x265 (Ubuntu package) - addressed in versions 1.17.6-1ubuntu4.7, 1.21.2-3ubuntu0.4
libheif-plugin-libde265 (Ubuntu package) - addressed in versions 1.17.6-1ubuntu4.7, 1.21.2-3ubuntu0.4
libheif-plugin-aomdec (Ubuntu package) - addressed in versions 1.17.6-1ubuntu4.7, 1.21.2-3ubuntu0.4
libheif-plugin-dav1d (Ubuntu package) - addressed in versions 1.17.6-1ubuntu4.7, 1.21.2-3ubuntu0.4
libheif-plugin-aomenc (Ubuntu package) - addressed in versions 1.17.6-1ubuntu4.7, 1.21.2-3ubuntu0.4
libheif-plugin-svtenc (Ubuntu package) - addressed in versions 1.17.6-1ubuntu4.7, 1.21.2-3ubuntu0.4
libheif-plugin-ffmpegdec (Ubuntu package) - addressed in versions 1.17.6-1ubuntu4.7, 1.21.2-3ubuntu0.4
libheif-plugin-jpegenc (Ubuntu package) - addressed in versions 1.17.6-1ubuntu4.7, 1.21.2-3ubuntu0.4
libheif-plugin-j2kdec (Ubuntu package) - addressed in versions 1.17.6-1ubuntu4.7, 1.21.2-3ubuntu0.4
libheif-plugin-jpegdec (Ubuntu package) - addressed in versions 1.17.6-1ubuntu4.7, 1.21.2-3ubuntu0.4
libheif-plugin-j2kenc (Ubuntu package) - addressed in versions 1.17.6-1ubuntu4.7, 1.21.2-3ubuntu0.4
libheif-plugins-all (Ubuntu package) - update to 1.21.2-3ubuntu0.4
libheif-plugin-kvazaar (Ubuntu package) - update to 1.21.2-3ubuntu0.4
heif-view (Ubuntu package) - update to 1.21.2-3ubuntu0.4
xeve - update to 0.7.1-1.fc46
xevd - update to 0.8.0-1.fc46
openjph - update to 0.32.0-1.fc46
libheif1-64bit - update to 1.12.0-150400.3.23.2
libheif1-64bit-debuginfo - update to 1.12.0-150400.3.23.2
libheif1-32bit - update to 1.12.0-150400.3.23.2
libheif1-32bit-debuginfo - update to 1.12.0-150400.3.23.2
gdk-pixbuf-loader-libheif - addressed in versions 1.12.0-150400.3.23.2, 1.23.1-150700.3.18.1
libheif-devel - addressed in versions 1.12.0-150400.3.23.2, 1.23.1-150700.3.18.1
libheif1-debuginfo - addressed in versions 1.12.0-150400.3.23.2, 1.23.1-150700.3.18.1
libheif-debugsource - addressed in versions 1.12.0-150400.3.23.2, 1.23.1-150700.3.18.1
libheif1 - addressed in versions 1.12.0-150400.3.23.2, 1.23.1-150700.3.18.1
gdk-pixbuf-loader-libheif-debuginfo - addressed in versions 1.12.0-150400.3.23.2, 1.23.1-150700.3.18.1
libheif-ffmpeg - update to 1.23.1-150700.3.18.1
libheif-rav1e-debuginfo - update to 1.23.1-150700.3.18.1
libheif-dav1d - update to 1.23.1-150700.3.18.1
libheif-rav1e - update to 1.23.1-150700.3.18.1
libheif-aom-debuginfo - update to 1.23.1-150700.3.18.1
libheif-jpeg-debuginfo - update to 1.23.1-150700.3.18.1
libheif-jpeg - update to 1.23.1-150700.3.18.1
libheif-aom - update to 1.23.1-150700.3.18.1
libheif-dav1d-debuginfo - update to 1.23.1-150700.3.18.1
libheif-ffmpeg-debuginfo - update to 1.23.1-150700.3.18.1
libheif - addressed in versions 1.23.5-3.el10_3, 1.23.5-3.el10_4, 1.23.6-3.fc46
OpenImageIO - update to 3.2.1.1-2.fc46
mingw-openexr - update to 3.4.15-2.fc46
aom - addressed in versions 3.13.3-1.el10_3, 3.13.3-1.el10_4
ffmpeg - update to 9.0.2-2.fc46
libheif (Debian package) - update to 1.19.8-1+deb13u1

• https://github.com/strukturag/libheif/security/advisories/GHSA-jc8f-p23p-5hjg

• Multiple vulnerabilities in libheif
• Debian update for libheif
• SUSE update for libheif
• Ubuntu update for libheif
• Ubuntu update for libheif
• SUSE update for libheif
• Fedora EPEL 10.4 update for aom, libheif
• Fedora EPEL 10.3 update for aom, libheif
• Fedora 46 update for OpenImageIO, ffmpeg, libheif, mingw-openexr, openjph, xevd, xeve