CVE-2026-62292: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-62292 is an out-of-bounds read vulnerability in the libheif library affecting the uncompressed (unci) tile range slicing code path. It was published on June 26, 2026 via a GitHub Security Advisory and affects libheif versions >= 1.19.0, with a fix available in v1.23.1. The vulnerability is classified as Moderate severity, with a CVSS category estimate of MEDIUM (GitHub Advisory, Feedly). It has also been tracked as a Debian-specific issue with no vendor-supplied patch available at the time of initial Debian disclosure (OSV).

The root cause is an integer overflow (CWE-125: Out-of-bounds Read) in unc_decoder::get_compressed_image_data_uncompressed() within libheif/codecs/uncompressed/unc_decoder.cc. The bounds check if (range_start_offset + range_size > data->size()) is vulnerable to uint64_t wraparound: a crafted HEIF file can set tile alignment parameters (row_align_size = 0xFFFFFFFF, tile_align_size = 0x80000000) and a large tile grid (4096×4096 tiles, 256 components) such that range_start_offset + range_size overflows to zero, bypassing the check entirely and passing an invalid 1 TiB source pointer and copy size to memcpy() (GitHub Advisory). The vulnerability is only reachable via the heif_image_handle_decode_image_tile() API — merely opening the file does not trigger it. A public PoC script and trigger harness are included in the advisory, demonstrating a SIGSEGV crash in __memmove_avx_unaligned_erms (GitHub Advisory).

Successful exploitation causes a denial of service (process crash via SIGSEGV) in any application that decodes advertised uncompressed image tiles from attacker-controlled HEIF files using libheif. Affected usage patterns include image services with tile extraction or region preview, progressive tile-loading viewers, converters, thumbnailers, and server-side tiled HEIF processing pipelines. No confidentiality impact has been demonstrated — the observed primitive is an invalid read during a large memory copy that crashes the process before any data disclosure occurs (GitHub Advisory).

A public proof-of-concept (PoC) Python script and C trigger harness are included in the GitHub Security Advisory, making exploitation straightforward for anyone targeting vulnerable applications. The CVE status remains "Reserved" with no EPSS score or CISA KEV catalog entry identified at this time. No in-the-wild exploitation or threat actor attribution has been reported. Detection plugins exist in Nessus (IDs 333377, 333527, 335100) and Qualys (ID 764546) (Feedly, Feedly).

1. Craft malicious HEIF file: Use the published PoC Python script to generate a crafted poc_unci_oob.heif file. The file advertises a 4096×4096 tile grid with 256 components, row_align_size=0xFFFFFFFF, tile_align_size=0x80000000, and a zlib-compressed payload that decompresses to a single byte.
2. Deliver the file: Supply the crafted HEIF file to a target application that uses libheif >= 1.19.0 for tile-based image decoding (e.g., an image service, thumbnailer, or converter that calls heif_image_handle_get_image_tiling() and then decodes individual tiles).
3. Trigger tile decoding: The application reads the advertised tiling metadata and requests the last valid tile (x=4095, y=4095) via heif_image_handle_decode_image_tile().
4. Integer overflow bypasses bounds check: Inside unc_decoder::get_compressed_image_data_uncompressed(), the computed range_start_offset + range_size wraps to zero in uint64_t arithmetic, bypassing the bounds check.
5. Crash via invalid memcpy: memcpy() is called with an invalid source pointer and a ~1 TiB copy size (RDX=0x10000000000), causing a SIGSEGV in __memmove_avx_unaligned_erms and crashing the application (GitHub Advisory).

• File System: Presence of crafted .heif files with unusually large tile grid metadata (e.g., 4096×4096 tile counts, extreme row_align_size or tile_align_size values), or files with unci item type and cmpC compression type set to zlib.
• Process: Application crashes (SIGSEGV) in processes using libheif, particularly in __memmove_avx_unaligned_erms or memcpy called from unc_decoder::get_compressed_image_data_uncompressed(); core dumps referencing heif_image_handle_decode_image_tile().
• Logs: Crash reports or application logs showing segmentation faults during HEIF tile decoding; error messages referencing unc_decoder, fetch_tile_data, or decode_uncompressed_image_tile (GitHub Advisory).

Upgrade libheif to version v1.23.1 or later, which contains the fix for this vulnerability (GitHub Advisory). SUSE has released an updated package via SUSE-SU-2026:3597-1 (SUSE Advisory). As a workaround where patching is not immediately possible, restrict or disable processing of HEIF files from untrusted sources in applications that use tile-based decoding APIs. The advisory recommends replacing addition-form range checks with overflow-safe subtraction-form validation and adding practical limits on row_align_size, tile_align_size, and computed tile data sizes.

SUSE issued a security update (SUSE-SU-2026:3597-1) addressing this and related libheif vulnerabilities (SUSE Advisory). openSUSE also published a security announcement via its mailing list (openSUSE). The German Linux security site pro-linux.de covered the issue as part of a broader libheif advisory (pro-linux.de). AusCERT published a bulletin (ESB-2026.9231) referencing the vulnerability (AusCERT).