The vulnerability in libheif (CVE-2026-62289) involves an integer underflow triggered by a crafted HEIF or AVIF file with a clean aperture box. When heif_image_handle_get_image_tiling(handle, 1, &tiling) is called, the image dimension can be reduced to zero due to double application of transformations: ImageItem::get_heif_image_tiling() returns already transformed dimensions, and process_image_transformations_on_tiling() applies the clean aperture transformation again. This leads to an underflow in Box_clap::left_rounded(0), where image_width minus one underflows and constructs a Fraction with a large numerator (0xFFFFFFFF). Debug builds assert and abort, while release builds may return corrupt crop and zero-width tiling results. The affected code spans image_item.cc, context.cc, and box.cc. The issue is resolved in libheif version 1.23.1.

The vulnerability can cause denial of service through application crashes or corrupted image processing results when handling maliciously crafted HEIF or AVIF files. There is no impact on confidentiality or integrity reported. The CVSS score is 4.3 (medium severity) with an attack vector of network, low complexity, no privileges required, user interaction required, and impact limited to availability.

This vulnerability is fixed in libheif version 1.23.1. Users and vendors should upgrade to version 1.23.1 or later to remediate the issue. No other mitigation or workaround is indicated by the vendor advisory.