libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF or AVIF file containing a clean aperture box can reduce an image dimension to zero and crash or corrupt tiling results when heif_image_handle_get_image_tiling(handle, 1, &tiling) is called. ImageItem::get_heif_image_tiling() returns already transformed dimensions, and process_image_transformations_on_tiling() applies the clean aperture transformation again. The second application passes zero to Box_clap::left_rounded(0), where image_width minus one underflows and constructs Fraction(0xFFFFFFFF, 2). Debug builds reach an assertion and abort, while release builds can return a corrupt crop and zero-width tiling result. The affected implementation spans libheif/image-items/image_item.cc, libheif/context.cc, and libheif/box.cc. This issue is fixed in version 1.23.1.
CVSS Details
- CVSS 3.1 Base Score: 4.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade libheif-tools-debuginfoUpgrade heif-pixbuf-loaderUpgrade libheif-debuginfoUpgrade libheif-toolsUpgrade libheif-debugsourceUpgrade libheifUpgrade heif-pixbuf-loader-debuginfoUpgrade libheif-devel | Sep 30, 2026 | Aug 18, 2026 |
| Debian | — | Upgrade libheif | Aug 9, 2026 | Aug 9, 2026 |
| Ubuntu | — | Upgrade heif-gdk-pixbufUpgrade libheif-devUpgrade libheif-plugin-libde265Upgrade libheif-plugins-allUpgrade libheif-plugin-aomdecUpgrade libheif-plugin-kvazaarUpgrade libheif-plugin-ffmpegdecUpgrade libheif-plugin-x265Upgrade heif-thumbnailer (Ubuntu Pro)Upgrade libheif-plugin-jpegencUpgrade libheif-plugin-svtencUpgrade libheif-plugin-dav1dUpgrade libheif-dev (Ubuntu Pro)Upgrade libheif-plugin-rav1eUpgrade libheif-plugin-jpegdecUpgrade heif-viewUpgrade libheif-plugin-aomencUpgrade heif-thumbnailerUpgrade libheif1Upgrade libheif1 (Ubuntu Pro)Upgrade libheif-plugin-j2kencUpgrade heif-gdk-pixbuf (Ubuntu Pro)Upgrade libheif-plugin-j2kdec | Aug 19, 2026 | Aug 19, 2026 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub