Security update for libheif
This update for libheif fixes the following issues: Update to version 1.23.1 (jsc#PED-16355). Security issues fixed: - CVE-2026-62289: integer underflow in Fraction constructor via double clap transform application (bsc#1273079). - CVE-2026-62291: heap out-of-bounds write in the uncompressed encoder when writing images with mismatched auxiliary alpha dimensions (bsc#1273080). - CVE-2026-62292: out-of-bounds read in uncompressed unci tile range slicing (bsc#1273081). - CVE-2026-62377: reachable assertion in `HeifContext::get_track()` aborts on a valid-but-empty HEIF sequence file (bsc#1273082). - Heap out-of-bounds write in the uncompressed encoder for RRGGBB images with interleaved bit-depth `<= 8` (bsc#1273083). Changes for libheif: - Version 1.23.1 + FFmpeg decoder plugin gains AV1, VVC, JPEG, and JPEG 2000/HTJ2K decoding. + SVT-AV1 encoder: new `tune=iq` and `ms-ssim` tune parameters. + C++ API: added getters/setters for the CLLI and MDCV HDR metadata boxes. + Sequence decoder now scales the alpha auxiliary track to the main image size. + Fixed pixi box writing for multi-channel images. + Corrected the placement of the TAI `clock_type` field into the top 2 bits. + Empty/unset plugin directory is no longer scanned.
Security update for libheif
Description
This update for libheif fixes the following issues: Update to version 1.23.1 (jsc#PED-16355). Security issues fixed: - CVE-2026-62289: integer underflow in Fraction constructor via double clap transform application (bsc#1273079). - CVE-2026-62291: heap out-of-bounds write in the uncompressed encoder when writing images with mismatched auxiliary alpha dimensions (bsc#1273080). - CVE-2026-62292: out-of-bounds read in uncompressed unci tile range slicing (bsc#1273081). - CVE-2026-62377: reachable assertion in `HeifContext::get_track()` aborts on a valid-but-empty HEIF sequence file (bsc#1273082). - Heap out-of-bounds write in the uncompressed encoder for RRGGBB images with interleaved bit-depth `<= 8` (bsc#1273083). Changes for libheif: - Version 1.23.1 + FFmpeg decoder plugin gains AV1, VVC, JPEG, and JPEG 2000/HTJ2K decoding. + SVT-AV1 encoder: new `tune=iq` and `ms-ssim` tune parameters. + C++ API: added getters/setters for the CLLI and MDCV HDR metadata boxes. + Sequence decoder now scales the alpha auxiliary track to the main image size. + Fixed pixi box writing for multi-channel images. + Corrected the placement of the TAI `clock_type` field into the top 2 bits. + Empty/unset plugin directory is no longer scanned.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- SUSE Product Security Team
- Advisory Id
- openSUSE-SU-2026:21644-1
- Cve Count
- 4
- Additional Cves
- ["CVE-2026-62291","CVE-2026-62292","CVE-2026-62377"]
Threat ID: 6aab495f55bf5e2cf5990af7
Added to database: 09/17/2026, 01:58:55 UTC
Last updated: 09/17/2026, 01:58:55 UTC
Views: 1
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.