libheif 1.18.0 before 1.23.3 Heap Buffer Overflow via unci Mixed-Interleave Decoder
Only libheif 1.18.0 through 1.23.2 built with WITH_UNCOMPRESSED_CODEC=ON is in scope, and only for the unci mixed-interleave path. Fixed in 1.23.3.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Fix
- Fixed in 1.23.3
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
libheif, an open-source library for decoding HEIF image files, is affected by a heap buffer overflow in its decoder for certain compressed image data. A specially crafted image file with mismatched chroma bit depths can cause memory to be written beyond its intended bounds, which could potentially allow an attacker to run arbitrary code in applications that process such images.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
libheif 1.18.0 before 1.23.3 contains a heap-based buffer overflow vulnerability in unc_decoder_mixed_interleave::processTile() that allows attackers to write out of bounds by supplying chroma components with unequal bit depths. Attackers can craft a HEIF file declaring, for example, 16-bit Cb and 8-bit Cr to trigger file-controlled heap writes past the Cr plane, potentially achieving code execution in image-processing pipelines.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- strukturag libheif
From 1.18.0 · fixed in 1.23.3
References 5
Questions about CVE-2026-120208
What does this mean?
Decoding a crafted HEIF file can trigger a heap out-of-bounds write in libheif's built-in unci decoder. The bug occurs when paired Cb and Cr components are declared at different bit depths, and the write can corrupt adjacent heap data. The advisory reports file disclosure and code execution on one specific deployment only.Source: github.com, github.com
Am I affected, and how do I check?
Versions 1.18.0 through 1.23.2 are in scope, and the advisory's reproduction is on 1.23.2. The library must be built with WITH_UNCOMPRESSED_CODEC=ON, and the file must use the unci mixed-interleave YCbCr path with Cb and Cr at different bit depths. To check a build, confirm the libheif version and whether that build option was enabled when it was compiled.Source: github.com, github.com
What should I do about it?
Upgrade libheif to 1.23.3, which is the fixed version and is described as a security and bugfix release.Source: github.com, github.com
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data