CVE-2026-62289 libheif: Integer underflow in Fraction constructor via double clap transform application
A crafted HEIF or AVIF file triggers an integer underflow in libheif, causing crashes or corrupt tiling results during image processing.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-62289?
CVE-2026-62289 is a medium-severity vulnerability in strukturag libheif, published on 18 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF or AVIF file containing a clean aperture box can reduce an image dimension to zero and crash or corrupt tiling results when heif_image_handle_get_image_tiling(handle, 1, &tiling) is called. ImageItem::get_heif_image_tiling() returns already transformed dimensions, and process_image_transformations_on_tiling() applies the clean aperture transformation again. The second application passes zero to Box_clap::left_rounded(0), where image_width minus one underflows and constructs Fraction(0xFFFFFFFF, 2). Debug builds reach an assertion and abort, while release builds can return a corrupt crop and zero-width tiling result. The affected implementation spans libheif/image-items/image_item.cc, libheif/context.cc, and libheif/box.cc. This issue is fixed in version 1.23.1.
Which versions are affected by CVE-2026-62289?
How do I fix CVE-2026-62289?
Upgrade to a fixed version.
Is CVE-2026-62289 being exploited?
There is no known exploitation of CVE-2026-62289 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-62289, DEBIAN-CVE-2026-62289, ECHO-ebfc-8101-ce00, GHSA-jc8f-p23p-5hjg, MINI-cmf9-rwvq-rc53.