TI-2026-83558 Aliases CVE-2026-120208 GHSA-wqmc-6h9q-v6wp

Heap buffer overflow in libheif mixed-interleave decoder

LOW 36CWE-122Published 2026-10-31 · Updated 2026-11-02

Key facts

Attack vector: Network
Privileges required: None
User interaction: Passive
Attack complexity: Low
Attack requirements: Present
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-122 and the CVSS impact.

Summary

libheif from 1.18.0 before 1.23.3 contains a heap-based buffer overflow (CWE-122) in the unc_decoder_mixed_interleave::processTile() function. The decoder fails to handle chroma components with unequal bit depths, so it writes past the end of a heap plane. An attacker can trigger this if a user opens a crafted HEIF file, potentially achieving code execution in image-processing pipelines.

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

Description from the CNA

libheif 1.18.0 before 1.23.3 contains a heap-based buffer overflow vulnerability in unc_decoder_mixed_interleave::processTile() that allows attackers to write out of bounds by supplying chroma components with unequal bit depths. Attackers can craft a HEIF file declaring, for example, 16-bit Cb and 8-bit Cr to trigger file-controlled heap writes past the Cr plane, potentially achieving code execution in image-processing pipelines.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00365 30th percentileScored 2026-11-07

Fix Fixed libheif (strukturag): 1.23.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
strukturag	libheif	1.18.0 to before 1.23.3	1.23.3	Patch available	CNA

libheif Vendorstrukturag Affected 1.18.0 to before 1.23.3 Fixed in 1.23.3 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:struktur:libheif::::::::	—	—	strukturag

cpe:2.3:a:struktur:libheif:*:*:*:*:*:*:*:* Versions — — ·strukturag

Remediation

Update libheif to version 1.23.3, the first fixed version.

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

Fix · CNA libheif (strukturag) Fixed in 1.23.3

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-31 Threatist record created from CVE-2026-120208
2026-10-31 Affected versions changed · Red Hat
2026-10-31 CVSS score added · Red Hat
2026-10-31 Alias added: GHSA-wqmc-6h9q-v6wp
2026-11-02 Priority changed: MEDIUM → LOW
2026-11-02 CISA SSVC decision points changed

References

Patch 1

https://github.com/strukturag/libheif/commit/9d3cd91d7b1c8c68deef6d06057ab956bcb0dfb9

Advisory 1

GitHub Security Advisory (GHSA-x8r2-mggj-j6wr)

Other 2

TI-2026-57994 libheif: Heap buffer overflow in `scale_nearest_neighbor()` via duplicate Alpha planes from nested `iden`/`auxl` items CVSS 3.1CRITICAL 9.8
TI-2026-25594 NULL Pointer Dereference in libde265 CVSS 4.0HIGH 8.7
TI-2023-27026 Libde265 v1.0.14 was discovered to contain a global buffer overflow vulnerability in the… CVSS 3.1HIGH 8.8
TI-2023-27020 libheif v1.17.5 was discovered to contain a segmentation violation via the function… CVSS 3.1HIGH 8.8
TI-2026-58037 Resource allocation without limits in strukturag libheif CVSS 3.1HIGH 7.5
TI-2026-57995 libheif: brotli/zlib decompression paths lack output-size limits, allowing decompression-bomb OOM/DoS CVSS 3.1HIGH 7.5

See all 113 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences