Live › vulnerability › CVE-2026-120208
libheif is an image library that decodes HEIF/HEIC photos. A crafted HEIF file with chroma planes of unequal bit depth causes a heap buffer overflow during decoding, which may let an attacker run code in an image-processing pipeline.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-31 18:37 UTC. All times on this page are UTC.
Exposure requires that the system decodes HEIF/HEIC files supplied by untrusted users, such as image upload, thumbnailing or conversion services. Systems that only handle local, trusted images or do not link libheif can skip it. The sources do not describe the exploitation requirements beyond supplying a crafted file.
No product ranges from the sources yet.
heif-info --version or your package manager (for example dpkg -l libheif1).pkg-config --modversion libheif on build hosts.1.23.3 or later (fixed in 1.23.3, affects 1.18.0 before 1.23.3).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
libheif 1.18.0 before 1.23.3 contains a heap-based buffer overflow vulnerability in unc_decoder_mixed_interleave::processTile() that allows attackers to write out of bounds by supplying chroma components with unequal bit depths. Attackers can craft a HEIF file declaring, for example, 16-bit Cb and 8-bit Cr to trigger file-controlled heap writes past the Cr plane, potentially achieving code execution in image-processing pipelines.
This page as .md · .json · in your agent: get_signal("CVE-2026-120208")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.