Vulnerability · Published Oct 31, 2026 · Assigned by VulnCheck
CVE-2026-120208libheif 1.18.0 before 1.23.3 Heap Buffer Overflow via unci Mixed-Interleave Decoder
High 7.5
In plain English
A high-severity heap buffer overflow in libheif from strukturag. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
libheif 1.18.0 before 1.23.3 contains a heap-based buffer overflow vulnerability in unc_decoder_mixed_interleave::processTile() that allows attackers to write out of bounds by supplying chroma components with unequal bit depths. Attackers can craft a HEIF file declaring, for example, 16-bit Cb and 8-bit Cr to trigger file-controlled heap writes past the Cr plane, potentially achieving code execution in image-processing pipelines.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | libheif | no fix listed | DEBIAN-CVE-2026-120208 |
| Debian:13 | libheif | 1.23.4-1~deb13u1 | DEBIAN-CVE-2026-120208 |
| Debian:14 | libheif | 1.23.3-1 | DEBIAN-CVE-2026-120208 |
| Ubuntu:26.04:LTS | libheif | no fix listed | UBUNTU-CVE-2026-120208 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| strukturag | libheif | 1.18.0 – before 1.23.3 |
Weakness: CWE-122 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- GitHub Security Advisory (GHSA-x8r2-mggj-j6wr) vendor-advisory
- https://github.com/strukturag/libheif/commit/9d3cd91d7b1c8c68deef6d06057ab956bcb0dfb9 patch
- libheif v1.23.3 Release Notes release-notes
- https://github.com/strukturag/libheif/blob/v1.23.2/libheif/codecs/uncompressed/unc_decoder_mixed_interleave.cc#L95 technical-description
- VulnCheck Advisory: libheif 1.18.0 before 1.23.3 Heap Buffer Overflow via unci Mixed-Interleave Decoder third-party-advisory