---
id: CVE-2026-120208
title: >-
  libheif 1.18.0 before 1.23.3 Heap Buffer Overflow via unci Mixed-Interleave
  Decoder
summary: >-
  libheif 1.18.0 before 1.23.3 contains a heap-based buffer overflow
  vulnerability in unc_decoder_mixed_interleave::processTile() that allows
  attackers to write out of bounds by supplying chroma components with unequal
  bit depths. Attacker…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-122
vendor: strukturag
product: libheif
affected:
  - libheif >= 1.18.0 < 1.23.3
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-11-02T17:09:44.328658Z'
published: '2026-10-31'
updated: '2026-11-02'
sourceUpdated: '2026-11-02T17:45:27.671Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-120208'
references:
  - url: >-
      https://github.com/strukturag/libheif/security/advisories/GHSA-x8r2-mggj-j6wr
    label: GitHub Security Advisory (GHSA-x8r2-mggj-j6wr)
  - url: >-
      https://github.com/strukturag/libheif/commit/9d3cd91d7b1c8c68deef6d06057ab956bcb0dfb9
  - url: 'https://github.com/strukturag/libheif/releases/tag/v1.23.3'
    label: libheif v1.23.3 Release Notes
  - url: >-
      https://github.com/strukturag/libheif/blob/v1.23.2/libheif/codecs/uncompressed/unc_decoder_mixed_interleave.cc#L95
  - url: >-
      https://www.vulncheck.com/advisories/libheif-1.18.0-before-1.23.3-heap-buffer-overflow-via-unci-mixed-interleave-decoder
    label: >-
      VulnCheck Advisory: libheif 1.18.0 before 1.23.3 Heap Buffer Overflow via
      unci Mixed-Interleave Decoder
tags:
  - cve.org
epss: 0.00365
epssPercentile: 0.3052
ingestedAt: '2026-11-05T19:30:42.749Z'
---

## Overview

libheif 1.18.0 before 1.23.3 contains a heap-based buffer overflow vulnerability in unc_decoder_mixed_interleave::processTile() that allows attackers to write out of bounds by supplying chroma components with unequal bit depths. Attackers can craft a HEIF file declaring, for example, 16-bit Cb and 8-bit Cr to trigger file-controlled heap writes past the Cr plane, potentially achieving code execution in image-processing pipelines.

## Affected

- `libheif >= 1.18.0 < 1.23.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.