Where
-Infinity
0

Trending

Last week
Last month
Last year

libheif libheiflibheif: Heap-Buffer-Overflow Write in Grid Tile Chroma Compositing

Risk 86
Severity
8.8
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Last updated 19 June 2026

1 / 2
Source: Ubuntu
First published (updated )
CVE-2026-32740

libheif libheiflibheif: Out-of-bounds read in uncompressed unci tile range slicing

Risk 47
Severity
8.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Last updated 19 August 2026

1 / 2
Source: Ubuntu
First published (updated )
CVE-2026-62292

libheif libheiflibheif 1.18.0 before 1.23.3 Heap Buffer Overflow via unci Mixed-Interleave Decoder

Risk 71
Severity
7.7
Buffer Overflow
AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

libheif 1.18.0 before 1.23.3 contains a heap-based buffer overflow vulnerability in uncdecodermixedinterleave::processTile() that allows attackers to write out of bounds by supplying chroma components with unequal bit depths. Attackers can craft a HEIF file declaring, for example, 16-bit Cb and 8-bit Cr to trigger file-controlled heap writes past the Cr plane, potentially achieving code execution in image-processing pipelines.

First published (updated )
GHSA-x8r2-mggj-j6wr

struktur Libheiflibheif <= 1.17.6 contains a memory leak in the function JpegEncoder::Encode. This flaw allows an at…

Risk 31
Severity
7.5
EPSS
0.04%
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

libheif <= 1.17.6 contains a memory leak in the function JpegEncoder::Encode. This flaw allows an attacker to cause a denial of service attack.

First published (updated )
CVE-2024-25269

libheif libheiflibheif Vulnerable to Heap Information Disclosure via Grid Image Gap + Uninitialized Pixel Plane Allocation

Risk 43
Severity
7.5
Infoleak
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, two bugs in libheif chain to leak process heap memory as visible pixel values in decoded grid images. An attacker who uploads a crafted AVIF/HEIC file to any server-side image processor (WordPress, Sharp/libvips, ImageMagick, etc.) can recover heap data - including library function pointers sufficient to defeat ASLR, or any other secret - from the publicly-downloadable transcoded JPEG/PNG/WebP output. Local attack vectors are also possible. Version 1.22.0 fixes the issue.

First published (updated )
CVE-2026-47247

libheif libheiflibheif: Sequence decode timing-table initialization allows non-terminating loops and unbounded memory, bypassing max_sequence_frames

Risk 43
Severity
7.5
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Last updated 24 September 2026

1 / 2
Source: Ubuntu
First published (updated )
CVE-2026-84446

libheif libheiflibheif: brotli/zlib decompression paths lack output-size limits, allowing decompression-bomb OOM/DoS

Risk 43
Severity
7.5
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Last updated 24 September 2026

1 / 2
Source: Ubuntu
First published (updated )
CVE-2026-84384

libheif libheiflibheif: Derived-image indirect reference chains and tiled offsets bypass decode caching and MemoryHandle limits, causing CPU/memory amplification DoS

Risk 43
Severity
7.5
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Last updated 24 September 2026

1 / 2
Source: Ubuntu
First published (updated )
CVE-2026-84447

libheif libheiflibheif has a heap buffer overflow in decode_mask_image()

Risk 47
Severity
7.1
Buffer Overflow
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

Last updated 19 June 2026

1 / 2
Source: Ubuntu
First published (updated )
CVE-2026-32741

libheif libheiflibheif: Heap Buffer OOB Read in overlay compositing due to wrong alpha stride

Risk 47
Severity
7.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

Last updated 19 June 2026

1 / 2
Source: Ubuntu
First published (updated )
CVE-2026-32882

libheif libheiflibheif has a Heap OOB Read/SEGV Crash via Zero samples_per_chunk

Risk 37
Severity
6.5
Null Pointer Dereference
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Last updated 19 June 2026

1 / 2
Source: Ubuntu
First published (updated )
CVE-2026-32738

libheif libheiflibheif is Vulnerable to Infinite Loop DoS via stts Sample Duration Lookup

Risk 37
Severity
6.5
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Last updated 19 June 2026

1 / 2
Source: Ubuntu
First published (updated )
CVE-2026-32739

libheif libheiflibheif: Uninitialized Heap Memory Information Leak via Failed Grid Tiles

Risk 37
Severity
6.5
Infoleak
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Last updated 19 June 2026

1 / 2
Source: Ubuntu
First published (updated )
CVE-2026-32814

libheif libheiflibheif allows Out-of-bounds vector access leading to invalid dereference (DoS)

Risk 37
Severity
6.5
Null Pointer Dereference
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Last updated 19 June 2026

1 / 2
Source: Ubuntu
First published (updated )
CVE-2026-41069

libheif libheiflibheif: Wrapped icef compressed-unit range check causes out-of-bounds read in uncompressed HEIF decoder

Risk 37
Severity
6.5
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Last updated 29 June 2026

1 / 2
Source: Ubuntu
First published (updated )
CVE-2026-49271

libheif libheiflibheif: Incomplete fix for CVE-2026-62292 leaves libheif vulnerable to an out-of-bounds read

Risk 37
Severity
6.5
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.3, the no-icef full-item branch of uncdecoder::getcompressedimagedatauncompressed() in libheif/codecs/uncompressed/uncdecoder.cc retains an addition-based range check that can wrap when a crafted uncompressed tile grid produces a large rangestartoffset and rangesize. The overflow makes the bounds comparison pass and allows heifimagehandledecodeimagetile() to call memcpy() with an invalid source pointer and a very large length when decoding a valid high-index advertised tile. This incomplete remediation of CVE-2026-62292 can reliably crash tile-processing applications, while whole-image decoding is not claimed to reach the demonstrated path. This issue is fixed in version 1.23.3.

First published (updated )
CVE-2026-84451

libheif libheiflibheif: Wrapped icef compressed-unit range check causes out-of-bounds read in uncompressed HEIF decoder

Risk 37
Severity
6.5
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.1, the uncompressed HEIF decoder validates explicit icef compressed-unit offsets using unitoffset + unitsize. Because the addition can wrap, a crafted HEIF file can pass the range check and then construct a vector from iterators outside the compressed item buffer, producing an out-of-bounds heap read and crash. Version 1.22.1 patches the issue.

First published (updated )
GHSA-r7qj-cg5r-r6vf

libheif libheiflibheif: Heap buffer over-read in SampleAuxInfoReader via crafted HEIF sequence file with mismatched saiz sample count

Risk 59
Severity
5.1
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Last updated 19 June 2026

1 / 2
Source: Ubuntu
First published (updated )
CVE-2026-41071

libheif libheiflibheif: Reachable assertion in HeifContext::get_track() aborts on a valid-but-empty HEIF sequence file (context.cc:2110)

Risk 22
Severity
4.3
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Last updated 18 September 2026

1 / 2
Source: Ubuntu
First published (updated )
CVE-2026-62377

libheif libheiflibheif: Integer underflow in Fraction constructor via double clap transform application

Risk 22
Severity
4.3
Integer Underflow
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Last updated 27 August 2026

1 / 2
Source: Ubuntu
First published (updated )
CVE-2026-62289

libheif libheiflibheif hOp_RGB24_32_to_YCbCr Memory Access Error / SEGV

Risk 20
Severity
3.7
Integer Overflow
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Last updated 24 September 2026

1 / 2
Source: Ubuntu
First published (updated )
CVE-2026-84449

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203