CVE-2026-62289

A flaw was found in libheif, a HEIF and AVIF file format decoder and encoder. A remote attacker could exploit this vulnerability by providing a specially crafted HEIF or AVIF file containing a clean aperture box. This can lead to an integer underflow when processing image transformations, causing...

Amazon Linux 2023 : heif-pixbuf-loader, libheif, libheif-devel (ALAS2023-2026-1814)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1814 advisory. libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.21.2 and prior contain a heap- buffer-overflow write vulnerability in the grid tile compositing, allowing an attacker to...

Linux Distros Unpatched Vulnerability : CVE-2026-32740

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.21.2 and prior contain a heap- buffer-overflow write vulnerability in the grid tile...

libheif 缓冲区错误漏洞

Libheif is a open-source decoder and encoder for the ISO/IEC 23008-12:2017 HEIF file format developed by Struktur. Versions of Libheif prior to 1.21.2 contain a buffer error vulnerability. This vulnerability stems from a heap buffer overflow during tile composition, allowing attackers to write...

[SECURITY] [DLA 3945-1] libheif security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3945-1 [email protected] https://www.debian.org/lts/security/ Chris Lamb November 05, 2024 https://wiki.debian.org/LTS -...

The vulnerability of the heif::Fraction::round() function in the box.cc file decoder for HEIF and AVIF formats in the libheif library allows a malicious actor to cause service interruptions.

The vulnerability of the heif::Fraction::round function in the box.cc file format decoders for HEIF and AVIF formats in the libheif library is related to a floating-point exception. Exploiting this vulnerability could allow an attacker to cause service failures...