Where
-Infinity
0

Trending

Last week
Last month
Last year

libheif libheiflibheif: Out-of-bounds read in uncompressed unci tile range slicing

Risk 47
Severity
8.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Last updated 19 August 2026

1 / 2
Source: Ubuntu
First published (updated )
CVE-2026-62292

libheif libheiflibheif: Reachable assertion in HeifContext::get_track() aborts on a valid-but-empty HEIF sequence file (context.cc:2110)

Risk 22
Severity
4.3
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF sequence accepted by heifcontextreadfrommemory() can leave the context with no registered sequence tracks and crash when heifcontextgettrack(ctx, 0) is called. HeifContext::gettrack() in libheif/context.cc executes assert(hassequence()) before its normal error handling, so assert-enabled builds abort instead of allowing the public wrapper in libheif/api/libheif/heifsequences.cc to return null. In release builds, removing the assertion lets the trackid zero path dereference mtracks.begin()->second on an empty map, which is undefined behavior and typically crashes. The issue is reachable through documented public APIs after parsing attacker-controlled bytes. This issue is fixed in version 1.23.1.

First published (updated )
CVE-2026-62377

libheif libheiflibheif: Integer underflow in Fraction constructor via double clap transform application

Risk 22
Severity
4.3
Integer Underflow
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Last updated 27 August 2026

1 / 2
Source: Ubuntu
First published (updated )
CVE-2026-62289

libheif libheiflibheif Vulnerable to Heap Information Disclosure via Grid Image Gap + Uninitialized Pixel Plane Allocation

Risk 43
Severity
7.5
Infoleak
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, two bugs in libheif chain to leak process heap memory as visible pixel values in decoded grid images. An attacker who uploads a crafted AVIF/HEIC file to any server-side image processor (WordPress, Sharp/libvips, ImageMagick, etc.) can recover heap data - including library function pointers sufficient to defeat ASLR, or any other secret - from the publicly-downloadable transcoded JPEG/PNG/WebP output. Local attack vectors are also possible. Version 1.22.0 fixes the issue.

First published (updated )
CVE-2026-47247

libheif libheiflibheif has a Heap OOB Read/SEGV Crash via Zero samples_per_chunk

Risk 37
Severity
6.5
Null Pointer Dereference
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Last updated 19 June 2026

1 / 2
Source: Ubuntu
First published (updated )
CVE-2026-32738

libheif libheiflibheif is Vulnerable to Infinite Loop DoS via stts Sample Duration Lookup

Risk 37
Severity
6.5
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Last updated 19 June 2026

1 / 2
Source: Ubuntu
First published (updated )
CVE-2026-32739

libheif libheiflibheif: Heap-Buffer-Overflow Write in Grid Tile Chroma Compositing

Risk 77
Severity
8.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Last updated 19 June 2026

1 / 2
Source: Ubuntu
First published (updated )
CVE-2026-32740

libheif libheiflibheif has a heap buffer overflow in decode_mask_image()

Risk 47
Severity
7.1
Buffer Overflow
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

Last updated 19 June 2026

1 / 2
Source: Ubuntu
First published (updated )
CVE-2026-32741

libheif libheiflibheif: Heap Buffer OOB Read in overlay compositing due to wrong alpha stride

Risk 47
Severity
7.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

Last updated 19 June 2026

1 / 2
Source: Ubuntu
First published (updated )
CVE-2026-32882

libheif libheiflibheif: Uninitialized Heap Memory Information Leak via Failed Grid Tiles

Risk 37
Severity
6.5
Infoleak
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Last updated 19 June 2026

1 / 2
Source: Ubuntu
First published (updated )
CVE-2026-32814

libheif libheiflibheif allows Out-of-bounds vector access leading to invalid dereference (DoS)

Risk 37
Severity
6.5
Null Pointer Dereference
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Last updated 19 June 2026

1 / 2
Source: Ubuntu
First published (updated )
CVE-2026-41069

libheif libheiflibheif: Heap buffer over-read in SampleAuxInfoReader via crafted HEIF sequence file with mismatched saiz sample count

Risk 59
Severity
5.1
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Last updated 19 June 2026

1 / 2
Source: Ubuntu
First published (updated )
CVE-2026-41071

libheif libheiflibheif: Wrapped icef compressed-unit range check causes out-of-bounds read in uncompressed HEIF decoder

Risk 37
Severity
6.5
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Last updated 29 June 2026

1 / 2
Source: Ubuntu
First published (updated )
CVE-2026-49271

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203