{"id":"CVE-2026-120208","kind":"vulnerability","aliases":["CVE-2026-120208"],"related":[],"title":"libheif: crafted HEIF file overflows heap and may run code","description":"libheif 1.18.0 before 1.23.3 contains a heap-based buffer overflow vulnerability in unc_decoder_mixed_interleave::processTile() that allows attackers to write out of bounds by supplying chroma components with unequal bit depths. Attackers can craft a HEIF file declaring, for example, 16-bit Cb and 8-bit Cr to trigger file-controlled heap writes past the Cr plane, potentially achieving code execution in image-processing pipelines.","summary":"libheif is an image library that decodes HEIF/HEIC photos. A crafted HEIF file with chroma planes of unequal bit depth causes a heap buffer overflow during decoding, which may let an attacker run code in an image-processing pipeline.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["heic","heif","image-processing","libheif","package"],"not_affected_if":["libheif-below-1.18.0","no-untrusted-heif-input"],"how_to_check":"- Check the installed libheif version with `heif-info --version` or your package manager (for example `dpkg -l libheif1`).\n- Look for libheif in application dependencies, such as `pkg-config --modversion libheif` on build hosts.\n- Find services that decode untrusted HEIF/HEIC uploads, since those are the exposed path.","fix":"- libheif: move to `1.23.3` or later (fixed in 1.23.3, affects 1.18.0 before 1.23.3).","status":"open","published_at":"2026-10-31T18:17:09+00:00","first_seen_at":"2026-10-31T18:37:13+00:00","triaged_at":"2026-10-31T18:40:35+00:00","updated_at":"2026-10-31T18:40:35+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-31T18:40:35Z","model":"claude-haiku-5-5","output":{"fix":"- libheif: move to `1.23.3` or later (fixed in 1.23.3, affects 1.18.0 before 1.23.3).","reach":"internet","title":"libheif: crafted HEIF file overflows heap and may run code","impact":"high","summary":"libheif is an image library that decodes HEIF/HEIC photos. A crafted HEIF file with chroma planes of unequal bit depth causes a heap buffer overflow during decoding, which may let an attacker run code in an image-processing pipeline.","audience":"businesses","category":"package","nicknames":[],"who_cares":["libheif","image-processing","heif","heic"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attacker may write past heap buffers and potentially execute code","analyst_note":"Confirm whether the fix version 1.23.3 is the only remediation and whether any public exploit or proof of concept exists; check the upstream libheif advisory.","how_to_check":"- Check the installed libheif version with `heif-info --version` or your package manager (for example `dpkg -l libheif1`).\n- Look for libheif in application dependencies, such as `pkg-config --modversion libheif` on build hosts.\n- Find services that decode untrusted HEIF/HEIC uploads, since those are the exposed path.","plain_action":"","needs_analyst":true,"not_affected_if":["libheif-below-1.18.0","no-untrusted-heif-input"],"who_is_affected":"Exposure requires that the system decodes HEIF/HEIC files supplied by untrusted users, such as image upload, thumbnailing or conversion services. Systems that only handle local, trusted images or do not link libheif can skip it. The sources do not describe the exploitation requirements beyond supplying a crafted file.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000746,"input_tokens":4188,"output_tokens":654,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-120208':13A,16A '-2026':12A,15A '1.18.0':65C '1.23.3':67C '16':107C '8':111C 'achiev':126C 'allow':83C 'attack':55B,84C,98C 'base':72C 'bit':42B,96C,108C,112C 'bound':89C 'buffer':47B,73C 'caus':44B 'cb':109C 'chroma':38B,92C 'code':10A,57B,127C 'compon':93C 'contain':68C 'control':118C 'cr':113C,123C 'craft':2A,34B,100C 'cve':11A,14A 'declar':104C 'decod':30B,50B,78C 'depth':43B,97C 'exampl':106C 'execut':128C 'file':4A,36B,103C,117C 'file-control':116C 'heap':6A,46B,71C,119C 'heap-bas':70C 'heic':17B 'heif':3A,18B,35B,102C 'heif/heic':31B 'imag':20B,27B,61B,131C 'image-process':19B,60B,130C 'interleav':80C 'let':53B 'libheif':1A,22B,24B,64C 'librari':28B 'may':8A,52B 'mix':79C 'overflow':5A,48B,74C 'packag':23B 'past':121C 'photo':32B 'pipelin':63B,133C 'plane':39B,124C 'potenti':125C 'process':21B,62B,132C 'processtil':81C 'run':9A,56B 'suppli':91C 'trigger':115C 'unc':77C 'unequ':41B,95C 'vulner':75C 'write':86C,120C","nicknames":[],"mitigations":[],"who_affected":"Exposure requires that the system decodes HEIF/HEIC files supplied by untrusted users, such as image upload, thumbnailing or conversion services. Systems that only handle local, trusted images or do not link libheif can skip it. The sources do not describe the exploitation requirements beyond supplying a crafted file.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-31T18:17:09+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120208","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120208","severity":null,"published_at":"2026-10-31T18:17:09+00:00","modified_at":"2026-10-31T18:17:09+00:00","first_seen_at":"2026-10-31T18:37:13+00:00","fetched_at":"2026-10-31T18:37:13+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}