CVE-2026-62289: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-62289 is an integer underflow vulnerability in the libheif ISO/IEC 23008-12 HEIF/AVIF image decoder/encoder library, caused by double application of the clean aperture (clap) transformation when the tiling API is invoked. A crafted HEIF/AVIF file with a clap box that reduces image dimensions to zero can trigger an assertion failure (debug builds) or undefined behavior (release builds), leading to denial of service or potentially worse outcomes. The vulnerability affects libheif versions up to and including 1.23.0, with the fix introduced in v1.23.1. It carries a CVSS v3.1 score of 4.3 (Moderate) per GitHub's overall score, or up to 7.5 (High) in server-side/no-UI-interaction scenarios (GitHub Advisory). The CVE was reserved and the advisory published on June 26, 2026 (GitHub Advisory).

The root cause is a double application of the clap (clean aperture) transformation: during HeifContext::interpret_heif_file(), image dimensions are already reduced to zero by the clap box (setting m_width=0), but process_image_transformations_on_tiling() iterates over all properties again and re-applies the clap, passing the already-zero width to Box_clap::left_rounded(0). This triggers Fraction(image_width - 1U, 2U) where image_width=0, causing an integer underflow (0 - 1U = 0xFFFFFFFF, CWE-191). In debug builds, the subsequent assert(num <= INT32_MAX) fires (CWE-617), causing SIGABRT; in release builds, the value silently wraps to -1, producing corrupt tiling data and undefined behavior (GitHub Advisory). Exploitation requires a user or automated service to open a specially crafted .heif, .avif, or .heic file with the tiling API called using process_image_transformations=1. The vulnerability was discovered via libFuzzer with AddressSanitizer on libheif 1.23.0 and is reproducible deterministically with a 523-byte crafted file (GitHub Advisory).

Successful exploitation causes a denial of service via application crash (SIGABRT in debug builds) or undefined behavior in release builds, which could corrupt tiling output or potentially be leveraged for further memory safety issues. In server-side deployments where HEIF/AVIF files are automatically processed (e.g., thumbnail generation services), an unauthenticated attacker can crash the service by uploading a malicious image, with no user interaction required. The Feedly description also notes potential for disclosure of sensitive memory contents or arbitrary code execution in broader exploitation scenarios, though the primary confirmed impact is availability loss (GitHub Advisory, Feedly).

A proof-of-concept exists in the form of a 523-byte crafted HEIF file that reproducibly triggers the crash 20/20 times under ASAN instrumentation, discovered via libFuzzer (GitHub Advisory). The vulnerability is detected by Nessus (plugins 333375, 333527, 335100) and Qualys (764546), indicating active scanner coverage (Feedly). No evidence of in-the-wild exploitation, threat actor attribution, or CISA KEV catalog listing has been reported. No EPSS score is currently available given the CVE's reserved status.

1. Craft malicious image: Create or obtain a crafted HEIF/AVIF file (as small as 523 bytes) containing a clean aperture (clap) box configured to reduce image dimensions to zero.
2. Identify target: Locate an application or service using libheif ≤ 1.23.0 that processes HEIF/AVIF images with the tiling API enabled (process_image_transformations=1), such as image thumbnail generators, media servers, or desktop image viewers.
3. Deliver the file: Submit the crafted file to the target — either by uploading it to a web service that auto-processes images, or by convincing a user to open it in a vulnerable application.
4. Trigger the vulnerability: When the application calls heif_image_handle_get_image_tiling(handle, 1, &tiling), the double clap application occurs, triggering the integer underflow in Fraction(0 - 1U, 2U).
5. Achieve DoS: In debug builds, the assert(num <= INT32_MAX) fires, causing SIGABRT and crashing the process. In release builds, undefined behavior results in corrupt tiling data, potentially crashing the application or causing further memory corruption (GitHub Advisory).

• File System: Presence of small (≈523-byte), syntactically valid but semantically malformed .heif, .avif, or .heic files with clap boxes specifying zero-dimension apertures in upload directories or temp folders.
• Logs: Application crash logs or core dumps referencing SIGABRT from libheif processes; stack traces mentioning heif_tiling.cc, image_item.cc, or box.cc in the call chain; ASAN output referencing Fraction constructor with value 0xFFFFFFFF.
• Process: Unexpected termination of image processing services or thumbnail generation daemons; repeated process restarts of services that handle HEIF/AVIF images.
• Network: Repeated uploads of small HEIF/AVIF files (under 1 KB) to image processing endpoints, particularly from the same source IP, which may indicate automated fuzzing or exploitation attempts (GitHub Advisory).

Upgrade libheif to version 1.23.1 or later, which contains the official patch for this vulnerability (GitHub Advisory). SUSE has released a security update (SUSE-SU-2026:3597-1) and openSUSE has issued a corresponding advisory for affected distributions (SUSE Advisory, openSUSE). As a temporary workaround, add a bounds check in Box_clap::left_rounded() to return 0 when image_width == 0, or configure services to reject HEIF/AVIF files before tiling API processing until the patch is applied (GitHub Advisory).

The vulnerability was reported by Feng Ning (feng@innora.ai) of Innora Security Research, discovered via libFuzzer with AddressSanitizer (GitHub Advisory). Linux distribution security teams including SUSE and openSUSE have responded promptly with security updates, and the issue has been tracked by AusCERT (ESB-2026.9231) and covered by Linux security news outlets (SUSE Advisory, openSUSE). The advisory notes cross-verification by five independent AI models, which is an unusual disclosure methodology that has drawn some attention in the security community.