---
id: "CVE-2026-120208"
kind: "vulnerability"
aliases: ["CVE-2026-120208"]
title: "libheif: crafted HEIF file overflows heap and may run code"
severity: "high"
cvss: 7.7
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["heic", "heif", "image-processing", "libheif", "package"]
not_affected_if: ["libheif-below-1.18.0", "no-untrusted-heif-input"]
published_at: "2026-10-31T18:17:09+00:00"
first_seen_at: "2026-10-31T18:37:13+00:00"
updated_at: "2026-10-31T18:40:35+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120208", "first_seen_at": "2026-10-31T18:37:13+00:00"}]
---

# libheif: crafted HEIF file overflows heap and may run code

libheif is an image library that decodes HEIF/HEIC photos. A crafted HEIF file with chroma planes of unequal bit depth causes a heap buffer overflow during decoding, which may let an attacker run code in an image-processing pipeline.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed libheif version with `heif-info --version` or your package manager (for example `dpkg -l libheif1`).
- Look for libheif in application dependencies, such as `pkg-config --modversion libheif` on build hosts.
- Find services that decode untrusted HEIF/HEIC uploads, since those are the exposed path.

## Fix

- libheif: move to `1.23.3` or later (fixed in 1.23.3, affects 1.18.0 before 1.23.3).

## Timeline

- 2026-10-31T18:37:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120208

## From the sources

libheif 1.18.0 before 1.23.3 contains a heap-based buffer overflow vulnerability in unc_decoder_mixed_interleave::processTile() that allows attackers to write out of bounds by supplying chroma components with unequal bit depths. Attackers can craft a HEIF file declaring, for example, 16-bit Cb and 8-bit Cr to trigger file-controlled heap writes past the Cr plane, potentially achieving code execution in image-processing pipelines.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_