{"id":"CVE-2026-62289","summary":"libheif: Integer underflow in Fraction constructor via double clap transform application","details":"libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF or AVIF file containing a clean aperture box can reduce an image dimension to zero and crash or corrupt tiling results when heif_image_handle_get_image_tiling(handle, 1, &tiling) is called. ImageItem::get_heif_image_tiling() returns already transformed dimensions, and process_image_transformations_on_tiling() applies the clean aperture transformation again. The second application passes zero to Box_clap::left_rounded(0), where image_width minus one underflows and constructs Fraction(0xFFFFFFFF, 2). Debug builds reach an assertion and abort, while release builds can return a corrupt crop and zero-width tiling result. The affected implementation spans libheif/image-items/image_item.cc, libheif/context.cc, and libheif/box.cc. This issue is fixed in version 1.23.1.","aliases":["GHSA-jc8f-p23p-5hjg"],"modified":"2026-09-11T08:36:37.434510Z","published":"2026-08-18T21:19:18.107Z","related":["SUSE-SU-2026:23320-1","SUSE-SU-2026:3597-1","openSUSE-SU-2026:11416-1","openSUSE-SU-2026:21644-1"],"database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-191","CWE-617"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/62xxx/CVE-2026-62289.json"},"references":[{"type":"WEB","url":"https://github.com/strukturag/libheif/releases/tag/v1.23.1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/62xxx/CVE-2026-62289.json"},{"type":"ADVISORY","url":"https://github.com/strukturag/libheif/security/advisories/GHSA-jc8f-p23p-5hjg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62289"},{"type":"FIX","url":"https://github.com/strukturag/libheif/commit/f01870c1d7323a3003796d58eba7fff502be994c"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/strukturag/libheif","events":[{"introduced":"0"},{"fixed":"f01870c1d7323a3003796d58eba7fff502be994c"},{"fixed":"2c4bbb54c2738d4a5efbbe3e5fa1d5d76bb88eb0"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"1.23.1"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["v1.23.0","v1.22.2","v1.22.1","v1.22.0","v1.21.2","v1.21.1","v1.21.0","v1.20.1","v1.20.0","v1.19.5","v1.19.4","v1.19.3","v1.19.2","v1.19.1","v1.19.0","v1.18.0","v1.18.0-rc1","v1.17.6","v1.17.5","v1.17.4","v1.17.3","v1.17.2","v1.17.1","v1.17.0","v1.16.2","v1.16.1","v1.16.0","v1.15.2","v1.15.1","v1.15.0","v1.14.2","v1.14.1","v1.14.0","v1.13.0","v1.12.0","v1.11.0","v1.10.0","v1.9.1","v1.9.0","v1.8.0","v1.7.0","v1.3.2","v1.3.1","v1.3.0","v1.2.0","v1.1.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-62289.json","vanir_signatures_modified":"2026-09-11T08:36:37Z","vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"127395858670301136793486932149164215610","length":203},"id":"CVE-2026-62289-24e6237a","signature_type":"Function","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/f01870c1d7323a3003796d58eba7fff502be994c","target":{"function":"Box_clap::left_rounded","file":"libheif/box.cc"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/f01870c1d7323a3003796d58eba7fff502be994c","target":{"function":"HeifContext::interpret_heif_file_images","file":"libheif/context.cc"},"deprecated":false,"digest":{"function_hash":"114392436950431329979051880312602366929","length":15468},"id":"CVE-2026-62289-31ac4bc0"},{"deprecated":false,"digest":{"line_hashes":["323137328082080423087660734327662310503","142063287348413789891995274982555633684","142571581072056934259932552695967204293","43439385830876584403406454163854039821","178638664231262657432982186554564778623"],"threshold":0.9},"id":"CVE-2026-62289-35df27eb","signature_type":"Line","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/f01870c1d7323a3003796d58eba7fff502be994c","target":{"file":"libheif/context.cc"}},{"source":"https://github.com/strukturag/libheif/commit/f01870c1d7323a3003796d58eba7fff502be994c","target":{"file":"libheif/image-items/image_item.cc","function":"ImageItem::get_heif_image_tiling"},"deprecated":false,"digest":{"function_hash":"14870450222820045138379254956867175695","length":457},"id":"CVE-2026-62289-591b8086","signature_type":"Function","signature_version":"v1"},{"target":{"file":"libheif/image-items/image_item.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["145229682300652585693118782209069082827","246830369201480860511003618966674959012","196553166530461776274663321217308631989","153861403205681785078860704978557782588","117124018368679202158853638335122164343","238335099759576789963087641100063220601","249906638590473267056020913689320663395"]},"id":"CVE-2026-62289-89fcbcf6","signature_type":"Line","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/f01870c1d7323a3003796d58eba7fff502be994c"},{"source":"https://github.com/strukturag/libheif/commit/f01870c1d7323a3003796d58eba7fff502be994c","target":{"file":"libheif/box.cc"},"deprecated":false,"digest":{"line_hashes":["260764375588819844769527973480645765516","99205648630810848018493836356580996209","291359666675066191902089483814190532795","151586271326732800389454718483207821948","214878245413007012147699939055865952766","334665012623755607457861870566110857900","133499985991179005616896380677891227346"],"threshold":0.9},"id":"CVE-2026-62289-d49f3fdf","signature_type":"Line","signature_version":"v1"},{"id":"CVE-2026-62289-ed26f71a","signature_type":"Function","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/f01870c1d7323a3003796d58eba7fff502be994c","target":{"file":"libheif/box.cc","function":"Box_clap::top_rounded"},"deprecated":false,"digest":{"function_hash":"271452116196700294234942391421722297466","length":196}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"}]}