DEBIAN-CVE-2026-84446

libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, crafted HEIF sequence timing and edit-list data can make Track::initsampletimingtable compute a logical mnumoutputsamples value that exceeds the uint32t counters used by TrackVisual::decodenextimagesample and...

UBUNTU-CVE-2026-84447

libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.1 and earlier, crafted grid, iovl, and iden reference graphs can repeatedly decode the same base image because processedids is copied per branch and ImageItem::decodeimage has no shared operation budget. This vulnerability is fix...

UBUNTU-CVE-2026-62291

libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted image sequence with a 2x2 primary plane and a 256x256 auxiliary alpha plane can cause attacker-controlled heap corruption during a normal decode and re-encode workflow. TrackVisual::decodenextimagesample...

CVE-2026-62289

libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF or AVIF file containing a clean aperture box can reduce an image dimension to zero and crash or corrupt tiling results when heifimagehandlegetimagetilinghandle, 1, &tiling is called...

EUVD-2026-62188

libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF or AVIF file containing a clean aperture box can reduce an image dimension to zero and crash or corrupt tiling results when heifimagehandlegetimagetilinghandle, 1, &tiling is called...

Amazon Linux 2023 : heif-pixbuf-loader, libheif, libheif-devel (ALAS2023-2026-1814)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1814 advisory. libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.21.2 and prior contain a heap- buffer-overflow write vulnerability in the grid tile compositing, allowing an attacker to...

graphicsmagick:coder_AVIF_fuzzer: Use-of-uninitialized-value in put_weighted_pred_8_fallback

Project: http://hg.code.sf.net/p/graphicsmagick/code Detailed Report: https://oss-fuzz.com/testcase?key=5982950700417024 Project: graphicsmagick Fuzzing Engine: libFuzzer Fuzz Target: coderAVIFfuzzer Job Type: libfuzzermsangraphicsmagick Platform Id: linux Crash Type: Use-of-uninitialized-value...

graphicsmagick:coder_AVIF_fuzzer: Use-of-uninitialized-value in Decoder_VVC::get_coded_image_colorspace

Project: http://hg.code.sf.net/p/graphicsmagick/code Detailed Report: https://oss-fuzz.com/testcase?key=6097828293443584 Project: graphicsmagick Fuzzing Engine: libFuzzer Fuzz Target: coderAVIFfuzzer Job Type: libfuzzermsangraphicsmagick Platform Id: linux Crash Type: Use-of-uninitialized-value...

[SECURITY] Fedora 36 Update: libheif-1.15.2-1.fc36

libheif is an ISO/IEC 23008-12:2017 HEIF and AVIF AV1 Image File Format file format decoder and encoder...

PYSEC-2021-892

libavif 0.8.0 and 0.8.1 has an out-of-bounds write in avifDecoderDataFillImageGrid...

kimageformats:kimgio_avif_fuzzer: Use-of-uninitialized-value in av1_selfguided_restoration_avx2

Project: git://anongit.kde.org/kimageformats Detailed Report: https://oss-fuzz.com/testcase?key=6123203164504064 Project: kimageformats Fuzzing Engine: libFuzzer Fuzz Target: kimgioaviffuzzer Job Type: libfuzzermsankimageformats Platform Id: linux Crash Type: Use-of-uninitialized-value Crash...

kimageformats:kimgio_avif_fuzzer: Use-of-uninitialized-value in cdef_find_dir_avx2

Project: git://anongit.kde.org/kimageformats Detailed Report: https://oss-fuzz.com/testcase?key=6570100937326592 Project: kimageformats Fuzzing Engine: libFuzzer Fuzz Target: kimgioaviffuzzer Job Type: libfuzzermsankimageformats Platform Id: linux Crash Type: Use-of-uninitialized-value Crash...

kimageformats:kimgio_avif_fuzzer: Use-of-uninitialized-value in QColorSpace::QColorSpace

Project: git://anongit.kde.org/kimageformats Detailed Report: https://oss-fuzz.com/testcase?key=5709815011737600 Project: kimageformats Fuzzing Engine: libFuzzer Fuzz Target: kimgioaviffuzzer Job Type: libfuzzermsankimageformats Platform Id: linux Crash Type: Use-of-uninitialized-value Crash...

kimageformats:kimgio_avif_fuzzer: Use-of-uninitialized-value in av1_predict_intra_block

Project: git://anongit.kde.org/kimageformats Detailed Report: https://oss-fuzz.com/testcase?key=5198064491036672 Project: kimageformats Fuzzing Engine: libFuzzer Fuzz Target: kimgioaviffuzzer Job Type: libfuzzermsankimageformats Platform Id: linux Crash Type: Use-of-uninitialized-value Crash...