CVE-2025-62821

Microsoft HEIF Image Extensions msheifstore.dll: CopyPixels 경로에서 소스 버퍼 미할당으로 인한 범위 초과 읽기 및 액세스 위반 DoS WIC를 통해 조작된 HEIF 이미지를 디코딩할 때, msheif 코덱은 1바이트 소스 버퍼를 할당하지만 이후 CopyPixels 중에 해당 버퍼에서 매우 많은 양의 픽셀 데이터를 복사하려고 시도합니다. 복사는 stride × ROI 높이에서 파생된 크기로 memmove를 사용하며, 소스 버퍼의 실제 길이를 검증하지 않습니다. 이로 인해 범위 초과...

Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : libheif vulnerabilities (USN-8846-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8846-1 advisory. Yuqi Qiu and Xiang Li discovered that libheif incorrectly handled certain compressed metadata. A remote...

USN-8846-1 libheif vulnerabilities

Yuqi Qiu and Xiang Li discovered that libheif incorrectly handled certain compressed metadata. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. CVE-2026-84384 Yuqi Qiu and Xiang Li discovered that libheif...

USN-8846-1: libheif vulnerabilities

Yuqi Qiu and Xiang Li discovered that libheif incorrectly handled certain compressed metadata. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. CVE-2026-84384 Yuqi Qiu and Xiang Li discovered that libheif...

[SECURITY] Fedora 43 Update: libheif-1.23.5-3.fc43

libheif is an ISO/IEC 23008-12:2017 HEIF and AVIF AV1 Image File Format file format decoder and encoder...

[SECURITY] Fedora 44 Update: libheif-1.23.5-3.fc44

libheif is an ISO/IEC 23008-12:2017 HEIF and AVIF AV1 Image File Format file format decoder and encoder...

CVE-2026-84383

A critical heap buffer overflow vulnerability exists in libheif versions 1.22.0 through 1.23.1. When decoding a maliciously crafted HEIF, HEIC, or AVIF file using nested iden and auxl references, HeifPixelImage::transferchannelfromimageas can inappropriately append duplicate Alpha planes with...

SUSE CVE-2026-96611

FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. In movreadispe, uint32t width/height values from a crafted HEIF ispe box are stored into signed int fields without bounds checking, allowing values exceeding INTMAX to become negative. In readimagegrid, accumulating these value...

[SECURITY] Fedora 45 Update: libheif-1.23.5-3.fc45

libheif is an ISO/IEC 23008-12:2017 HEIF and AVIF AV1 Image File Format file format decoder and encoder...

Linux Distros Unpatched Vulnerability : CVE-2026-96611

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. In movreadispe, uint32t width/height values from a crafted HEIF ispe box are stored into...

DEBIAN-CVE-2026-96611

FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. In movreadispe, uint32t width/height values from a crafted HEIF ispe box are stored into signed int fields without bounds checking, allowing values exceeding INTMAX to become negative. In readimagegrid, accumulating these value...

CVE-2026-96611

FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. In movreadispe, uint32t width/height values from a crafted HEIF ispe box are stored into signed int fields without bounds checking, allowing values exceeding INTMAX to become negative. In readimagegrid, accumulating these value...

CVE-2026-96611

FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. In movreadispe, uint32t width/height values from a crafted HEIF ispe box are stored into signed int fields without bounds checking, allowing values exceeding INTMAX to become negative. In readimagegrid, accumulating these value...

UBUNTU-CVE-2026-96611

FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. In movreadispe, uint32t width/height values from a crafted HEIF ispe box are stored into signed int fields without bounds checking, allowing values exceeding INTMAX to become negative. In readimagegrid, accumulating these value...

Integer Overflow or Wraparound

Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound via the movreadispe and readimagegrid paths in libavformat/mov.c. An attacker can trigger the flaw by supplying a crafted HEIF file with oversized ispe width and height values, causing them to be stored as...

CVE-2026-96611

A flaw was found in FFmpeg. A local attacker can craft a malicious High Efficiency Image File Format HEIF file that, when processed, can cause a signed integer overflow. This overflow allows width and height values to become negative, bypassing internal validity checks. This can lead to data...

EUVD-2026-85311

FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. In movreadispe, uint32t width/height values from a crafted HEIF ispe box are stored into signed int fields without bounds checking, allowing values exceeding INTMAX to become negative. In readimagegrid, accumulating these value...

CVE-2026-96611

FFmpeg versions before 9.0 are vulnerable to a signed integer overflow in libavformat/mov.c. When processing a crafted HEIF file, the mov_read_ispe() function stores uint32_t width and height values into signed integer fields without bounds checking, causing values exceeding INT_MAX to become neg...

CVE-2026-96611

FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. In movreadispe, uint32t width/height values from a crafted HEIF ispe box are stored into signed int fields without bounds checking, allowing values exceeding INTMAX to become negative. In readimagegrid, accumulating these value...

CVE-2026-96611

FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. In movreadispe, uint32t width/height values from a crafted HEIF ispe box are stored into signed int fields without bounds checking, allowing values exceeding INTMAX to become negative. In readimagegrid, accumulating these value...