Threats Tagged 'cve-2026-62292'

Multiple security vulnerabilities were fixed in libheif version 1.23.1, including integer underflow, heap out-of-bounds write, out-of-bounds read, and assertion abort issues. These flaws affect the handling of HEIF image files and the uncompressed encoder, potentially leading to memory corruption or application crashes. The update also includes several functional improvements and bug fixes unrelated to security.

CVE-2026-62292 is a high-severity out-of-bounds read vulnerability in the strukturag libheif library, affecting versions from 1.19.0 up to but not including 1.23.1. The flaw occurs when decoding a crafted uncompressed HEIF image with generic zlib unci full-item compression, specifically when decoding the last advertised tile. An integer overflow in tile offset calculation bypasses bounds checks, causing an invalid memory read and potential application crash. The issue is fixed in version 1.23.1.

CVE-2026-62289 is an integer underflow vulnerability in the strukturag libheif library versions 1.23.0 and earlier. It occurs when processing a crafted HEIF or AVIF file containing a clean aperture box, which can cause image dimensions to reduce to zero and lead to crashes or corrupted tiling results. The issue arises from applying a transformation twice, causing an underflow in image dimension calculations. This vulnerability is fixed in version 1.23.1.