
PatchHawk@patchhawk_
Patch
The worst one is now CVE-2026-62291 - rated High, CVSS 8.2. A HEIF image whose alpha plane is larger than the picture makes libheif's uncompressed encoder write past its heap buffer. The fix adds one guard: do the plane sizes match the image? https://t.co/9YneuqKmr2
Post summary
CVE-2026-62291 is a high‑severity heap buffer overflow in libheif’s uncompressed encoder, and a patch that validates plane sizes has been released.
12020185
60 followersView on X
