libheif: Heap-based buffer overflow in unc_decoder_mixed_interleave (CVE-2026-120208)

libheif versions 1.18.0 through 1.23.2 are susceptible to a heap-based buffer overflow within the unc_decoder_mixed_interleave::processTile() function. The vulnerability is triggered when the library processes a maliciously crafted HEIF file that declares unequal bit depths for chroma components, such as a 16-bit Cb component combined with an 8-bit Cr component. This discrepancy causes an out-of-bounds write to the heap, which may result in application crashes or arbitrary code execution in the context of the processing pipeline.

Impact

Successful exploitation may allow an unauthenticated attacker to execute arbitrary code within the memory space of an application leveraging the libheif library to decode images. Impact depends on the privileges of the application and the environment where image processing occurs.

Recommendation

• Upgrade the libheif library to version 1.23.3 or later across all applications and services that use the library for image processing.
• Audit services (such as web servers, image hosting platforms, or content management systems) to identify instances where libheif is used to handle untrusted user-uploaded content.
• Implement strict input validation or sandboxing for any image-processing pipelines utilizing older, unpatched versions of libheif.