Cloudanix VulnDB

CVE-2026-120208

High · 7.5

CVSS

7.5

EPSS

0.4%

Published

Oct 31, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A bug in a common library for reading certain image files could let attackers take over a computer if someone opens a specially made picture.

Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
Moderate
Impact
Remote Code Execution
Component
Library
Class
Buffer Overflow
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Heap-based buffer overflow in unc_decoder_mixed_interleave::processTile() permits out-of-bounds writes when a HEIF file supplies chroma components with unequal bit depths, allowing controlled heap corruption.

Why it matters to the business

Applications that decode HEIF images may crash or execute attacker-supplied code, leading to service disruption or full system compromise in image-processing pipelines.

How an attack unfolds

An attacker crafts a HEIF file that declares mismatched bit depths for Cb and Cr planes, delivers the file to a target application using the vulnerable libheif library, and triggers decoding to achieve out-of-bounds writes that can be leveraged for code execution.

How to fix it

Upgrade libheif to version 1.23.3 or later in all dependent applications and rebuild any statically linked binaries.

How to confirm the fix worked

Verify installed libheif version is 1.23.3 or newer; test decoding of sample HEIF files with mixed chroma bit depths in a controlled environment.

Typical attack path

  1. Craft a malicious HEIF file with unequal chroma bit depths
  2. Deliver the file via email, web download, or storage media
  3. Victim application loads and decodes the file using libheif
  4. Out-of-bounds write occurs during tile processing, leading to code execution

How to detect it

Monitor application crash logs for segmentation faults or heap corruption during HEIF decoding; inspect inbound HEIF files for unusual chroma bit-depth declarations in image metadata.

What your security team should do

  • Immediately inventory all software using libheif and schedule updates
  • Block or sandbox untrusted HEIF image processing until patched
  • Add HEIF file type to content filtering rules where feasible

The record

libheif 1.18.0 before 1.23.3 contains a heap-based buffer overflow vulnerability in unc_decoder_mixed_interleave::processTile() that allows attackers to write out of bounds by supplying chroma components with unequal bit depths. Attackers can craft a HEIF file declaring, for example, 16-bit Cb and 8-bit Cr to trigger file-controlled heap writes past the Cr plane, potentially achieving code execution in image-processing pipelines.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities