CVE-2026-120208 Details
Description
libheif 1.18.0 before 1.23.3 contains a heap-based buffer overflow vulnerability in unc_decoder_mixed_interleave::processTile() that allows attackers to write out of bounds by supplying chroma components with unequal bit depths. Attackers can craft a HEIF file declaring, for example, 16-bit Cb and 8-bit Cr to trigger file-controlled heap writes past the Cr plane, potentially achieving code execution in image-processing pipelines.
A heap-based buffer overflow vulnerability has been identified in libheif versions 1.18.0 prior to 1.23.3. The issue arises in the uncompressed image decoder, specifically within the mixed-interleave processing of chroma components. The vulnerability allows attackers to write out of bounds by supplying unequal bit depths for the chroma channels, such as 16-bit Cb and 8-bit Cr. This misalignment triggers heap corruption by overwriting memory past the intended buffer, with the potential for code execution in image-processing environments.
Users are advised to upgrade to libheif version 1.23.3, which addresses this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 31, 2026CISA-ADP
Assessed Nov 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-122 | Heap-based Buffer Overflow | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| libheif | >= 1.18.0, <= 1.23.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 2, 2026 | CVE Modified | CISA-ADP |
| Oct 31, 2026 | New CVE Received | [email protected] |