Threats Tagged 'cve-2026-62291'

CVE-2026-62291 is a medium severity vulnerability in strukturag's libheif (version 1.23.0 and earlier) involving an out-of-bounds read and write caused by inconsistent handling of auxiliary alpha plane dimensions during image decoding and encoding. This flaw can lead to heap corruption when processing crafted image sequences with mismatched primary and auxiliary plane sizes. The issue is fixed in libheif version 1.23.1.

Multiple security vulnerabilities were fixed in libheif version 1.23.1, including integer underflow, heap out-of-bounds write, out-of-bounds read, and assertion abort issues. These flaws affect the handling of HEIF image files and the uncompressed encoder, potentially leading to memory corruption or application crashes. The update also includes several functional improvements and bug fixes unrelated to security.

CVE-2026-62289 is an integer underflow vulnerability in the strukturag libheif library versions 1.23.0 and earlier. It occurs when processing a crafted HEIF or AVIF file containing a clean aperture box, which can cause image dimensions to reduce to zero and lead to crashes or corrupted tiling results. The issue arises from applying a transformation twice, causing an underflow in image dimension calculations. This vulnerability is fixed in version 1.23.1.