CVE-2026-120208 libheif 1.18.0 before 1.23.3 Heap Buffer Overflow via unci Mixed-Interleave Decoder
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-120208?
CVE-2026-120208 is a high-severity vulnerability in strukturag libheif, published on 31 Oct 2026.
Official description
libheif 1.18.0 before 1.23.3 contains a heap-based buffer overflow vulnerability in unc_decoder_mixed_interleave::processTile() that allows attackers to write out of bounds by supplying chroma components with unequal bit depths. Attackers can craft a HEIF file declaring, for example, 16-bit Cb and 8-bit Cr to trigger file-controlled heap writes past the Cr plane, potentially achieving code execution in image-processing pipelines.
Weakness: CWE-122
Which versions are affected by CVE-2026-120208?
How do I fix CVE-2026-120208?
Upgrade to a fixed version.
Is CVE-2026-120208 being exploited?
There is no known exploitation of CVE-2026-120208 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-120208, GHSA-wqmc-6h9q-v6wp, GHSA-x8r2-mggj-j6wr, ROOT-OS-DEBIAN-12-CVE-2026-120208, UBUNTU-CVE-2026-120208, USN-9012-1.