The vulnerability in libheif (CVE-2026-62292) involves an out-of-bounds read caused by an integer overflow in the calculation of tile offsets during decoding of uncompressed HEIF images using generic zlib unci full-item compression. Specifically, in the functions unc_decoder::fetch_tile_data() and unc_decoder::get_compressed_image_data_uncompressed(), the addition of range_start_offset and range_size can wrap to zero for the last advertised tile (4095, 4095), bypassing the bounds check and resulting in memcpy being called with an invalid source pointer and an excessively large length (one terabyte). This leads to a process crash. The vulnerability affects libheif versions from 1.19.0 through 1.23.0 and is fixed in 1.23.1.

An attacker can craft a malicious uncompressed HEIF image that, when decoded with heif_image_handle_decode_image_tile(), triggers an out-of-bounds read causing the application to crash. This can lead to denial of service. There is no indication of code execution or data corruption beyond the crash. The vulnerability does not trigger on simply opening the file; tile decoding is required.

This vulnerability is fixed in libheif version 1.23.1. Users and developers should upgrade to version 1.23.1 or later to remediate this issue. Since no official patch links or advisories are provided, verify the fix by consulting the libheif project release notes or repository. No other mitigations are indicated.