Where
-Infinity
0

Trending

Last week
Last month
Last year

Versions

1.19.0
2

debian/libheiflibheif: heap OOB read in ImageItem_Grid::decode_grid_tile via irot-induced tile-coordinate underflow

Risk 47
Severity
7.1
Integer Underflow
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

Last updated 10 July 2026

1 / 2
Source: Ubuntu
First published (updated )
CVE-2026-48029

debian/libheiflibheif has a NULL pointer dereference in heif_image_handle_get_image_tiling for malformed unci image missing ispe

Risk 38
Severity
6.9
Null Pointer Dereference
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Last updated 10 July 2026

1 / 2
Source: Ubuntu
First published (updated )
CVE-2026-47709

debian/libheiflibheif Has Heap Buffer Overflow in `Track::get_next_sample_raw_data()` -- OOB Chunk Vector Access

Risk 41
Severity
6.1
AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

Last updated 10 July 2026

1 / 2
Source: Ubuntu
First published (updated )
CVE-2026-47254

Futo libheiflibheif has an incomplete fix for CVE-2026-3949: integer overflow bypass in vvdec_push_data2

Risk 45
Severity
6.8
Integer Overflow
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

libheif is a HEIF and AVIF file format decoder and encoder. The fix for CVE-2026-3949 (commit b97c8b5, PR #1712) introduced an integer overflow in the very security check it added. The check itself can be bypassed, allowing a crafted HEIF file with a VVC track to trigger the same out-of-bounds heap read that CVE-2026-3949 was meant to prevent. This is a separate, currently-unpatched vulnerability. Issue #1712 was closed as fixed without testing the edge case where size is near UINT32MAX. Version 1.22.0 patches the issue.

First published (updated )
CVE-2026-47251

libheif libheiflibheif Vulnerable to Heap Information Disclosure via Grid Image Gap + Uninitialized Pixel Plane Allocation

Risk 43
Severity
7.5
Infoleak
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, two bugs in libheif chain to leak process heap memory as visible pixel values in decoded grid images. An attacker who uploads a crafted AVIF/HEIC file to any server-side image processor (WordPress, Sharp/libvips, ImageMagick, etc.) can recover heap data - including library function pointers sufficient to defeat ASLR, or any other secret - from the publicly-downloadable transcoded JPEG/PNG/WebP output. Local attack vectors are also possible. Version 1.22.0 fixes the issue.

First published (updated )
CVE-2026-47247

debian/libheiflibheif has Heap Out Of Bounds Write in unci subsystem

Risk 68
Severity
7.8
AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

Last updated 29 June 2026

1 / 2
Source: Ubuntu
First published (updated )
CVE-2026-47178

debian/libheiflibheif has integer overflow in inline mask size calculation that causes undersized buffer allocation

Risk 41
Severity
6.1
Integer Overflow
AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

Last updated 10 July 2026

1 / 2
Source: Ubuntu
First published (updated )
CVE-2026-47714

libheif libheiflibheif: Wrapped icef compressed-unit range check causes out-of-bounds read in uncompressed HEIF decoder

Risk 37
Severity
6.5
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Last updated 29 June 2026

1 / 2
Source: Ubuntu
First published (updated )
CVE-2026-49271

libheif libheiflibheif: Heap buffer over-read in SampleAuxInfoReader via crafted HEIF sequence file with mismatched saiz sample count

Risk 59
Severity
5.1
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Last updated 19 June 2026

1 / 2
Source: Ubuntu
First published (updated )
CVE-2026-41071

libheif libheiflibheif allows Out-of-bounds vector access leading to invalid dereference (DoS)

Risk 37
Severity
6.5
Null Pointer Dereference
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Last updated 19 June 2026

1 / 2
Source: Ubuntu
First published (updated )
CVE-2026-41069

libheif libheiflibheif: Heap-Buffer-Overflow Write in Grid Tile Chroma Compositing

Risk 77
Severity
8.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Last updated 19 June 2026

1 / 2
Source: Ubuntu
First published (updated )
CVE-2026-32740

libheif libheiflibheif is Vulnerable to Infinite Loop DoS via stts Sample Duration Lookup

Risk 37
Severity
6.5
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Last updated 19 June 2026

1 / 2
Source: Ubuntu
First published (updated )
CVE-2026-32739

libheif libheiflibheif has a Heap OOB Read/SEGV Crash via Zero samples_per_chunk

Risk 37
Severity
6.5
Null Pointer Dereference
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Last updated 19 June 2026

1 / 2
Source: Ubuntu
First published (updated )
CVE-2026-32738

libheiflibheif has Potential Heap Buffer Over-Read

Risk 47
Severity
7.1
Integer Overflow
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

libheif is an HEIF and AVIF file format decoder and encoder. Prior to version 1.21.0, a crafted HEIF that exercises the overlay image item path triggers a heap buffer over-read in HeifPixelImage::overlay(). The function computes a negative row length (likely from an unclipped overlay rectangle or invalid offsets), which then underflows when converted to sizet and is passed to memcpy, causing a very large read past the end of the source plane and a crash. Version 1.21.0 contains a patch. As a workaround, avoid decoding images using iovl overlay boxes.

First published (updated )
CVE-2025-68431

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203