{"id":"CVE-2026-62291","summary":"libheif: Heap out of bounds write in libheif uncompressed encoder when writing images with mismatched auxiliary alpha dimensions","details":"libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted image sequence with a 2x2 primary plane and a 256x256 auxiliary alpha plane can cause attacker-controlled heap corruption during a normal decode and re-encode workflow. Track_Visual::decode_next_image_sample() calls transfer_channel_from_image_as() without checking that the auxiliary alpha dimensions match the main frame. The resulting inconsistent image reaches heif_track_decode_next_image() and then heif_context_encode_image(). In unc_encoder::encode(), unc_encoder_component_interleave::encode_tile() sizes its buffer with compute_tile_data_size_bytes() using the primary dimensions but copies each component using its actual plane dimensions. The oversized alpha plane is therefore copied beyond the allocation, causing an out-of-bounds write; the inverse size mismatch can also produce an out-of-bounds read. This issue is fixed in version 1.23.1.","aliases":["GHSA-xpw3-9rhw-482x"],"modified":"2026-09-11T08:36:37.738695Z","published":"2026-08-18T21:21:32.182Z","related":["SUSE-SU-2026:23320-1","SUSE-SU-2026:3597-1","openSUSE-SU-2026:11416-1","openSUSE-SU-2026:21644-1"],"database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-125","CWE-787"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/62xxx/CVE-2026-62291.json"},"references":[{"type":"WEB","url":"https://github.com/strukturag/libheif/releases/tag/v1.23.1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/62xxx/CVE-2026-62291.json"},{"type":"ADVISORY","url":"https://github.com/strukturag/libheif/security/advisories/GHSA-xpw3-9rhw-482x"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62291"},{"type":"FIX","url":"https://github.com/strukturag/libheif/commit/ac5521ad50399885de96bb6a0733a5d2442740f9"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/strukturag/libheif","events":[{"introduced":"0"},{"fixed":"ac5521ad50399885de96bb6a0733a5d2442740f9"},{"fixed":"2c4bbb54c2738d4a5efbbe3e5fa1d5d76bb88eb0"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"1.23.1"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["v1.23.0","v1.22.2","v1.22.1","v1.22.0","v1.21.2","v1.21.1","v1.21.0","v1.20.1","v1.20.0","v1.19.5","v1.19.4","v1.19.3","v1.19.2","v1.19.1","v1.19.0","v1.18.0","v1.18.0-rc1","v1.17.6","v1.17.5","v1.17.4","v1.17.3","v1.17.2","v1.17.1","v1.17.0","v1.16.2","v1.16.1","v1.16.0","v1.15.2","v1.15.1","v1.15.0","v1.14.2","v1.14.1","v1.14.0","v1.13.0","v1.12.0","v1.11.0","v1.10.0","v1.9.1","v1.9.0","v1.8.0","v1.7.0","v1.3.2","v1.3.1","v1.3.0","v1.2.0","v1.1.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-62291.json","vanir_signatures_modified":"2026-09-11T08:36:37Z","vanir_signatures":[{"target":{"file":"libheif/codecs/uncompressed/unc_encoder.cc","function":"unc_encoder::encode"},"deprecated":false,"digest":{"function_hash":"196621563875232672326975017639418466314","length":1991},"id":"CVE-2026-62291-2123b5fb","signature_type":"Function","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/ac5521ad50399885de96bb6a0733a5d2442740f9"},{"deprecated":false,"digest":{"line_hashes":["293395063892101953258080744798451347796","200297442726296910814761521898004405792","258223894114559044881824964583410561485"],"threshold":0.9},"id":"CVE-2026-62291-3833fea8","signature_type":"Line","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/ac5521ad50399885de96bb6a0733a5d2442740f9","target":{"file":"libheif/codecs/uncompressed/unc_encoder.h"}},{"target":{"file":"libheif/codecs/uncompressed/unc_encoder.cc"},"deprecated":false,"digest":{"line_hashes":["34033797850869162351072586973842857089","79161378973817674341721236884539057353","184479302279232768650820080103922531901","317675565127953322536838477041370862769","23374754115428411822086913696571082841","254957459140435460146804778449576390210"],"threshold":0.9},"id":"CVE-2026-62291-743d4de7","signature_type":"Line","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/ac5521ad50399885de96bb6a0733a5d2442740f9"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"}]}