CVE-2026-84383

libheif is a HEIF and AVIF file format decoder and encoder. From 1.22.0 until 1.23.2, a crafted HEIF, HEIC, or AVIF item graph using nested iden and auxl references can make HeifPixelImage::transferchannelfromimageas append duplicate Alpha planes with different bit depths to mstorage...

CVE-2026-84450

libheif versions 1.19.0 through 1.23.3 are affected by a crafted-image vulnerability in the tiling API. A HEIF/AVIF image containing a clap property with an ispe width or height exceeding INT32_MAX + 1 triggers crop calculations via heif_image_handle_get_image_tiling(). The Fraction::Fraction() u...

[SECURITY] Fedora 45 Update: libheif-1.23.3-2.fc45

libheif is an ISO/IEC 23008-12:2017 HEIF and AVIF AV1 Image File Format file format decoder and encoder...

Linux Distros Unpatched Vulnerability : CVE-2026-62377

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF sequence accepted by heifcontextreadfrommemory can leave the...

CVE-2026-62377 libheif: Reachable assertion in HeifContext::get_track() aborts on a valid-but-empty HEIF sequence file (context.cc:2110)

libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF sequence accepted by heifcontextreadfrommemory can leave the context with no registered sequence tracks and crash when heifcontextgettrackctx, 0 is called. HeifContext::gettrack in libheif/context.cc...

EUVD-2026-62188

libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF or AVIF file containing a clean aperture box can reduce an image dimension to zero and crash or corrupt tiling results when heifimagehandlegetimagetilinghandle, 1, &tiling is called...

graphicsmagick:coder_HEIF_fuzzer: Use-of-uninitialized-value in parse_sps_for_avcC_configuration

Project: http://hg.code.sf.net/p/graphicsmagick/code Detailed Report: https://oss-fuzz.com/testcase?key=6268196932616192 Project: graphicsmagick Fuzzing Engine: libFuzzer Fuzz Target: coderHEIFfuzzer Job Type: libfuzzermsangraphicsmagick Platform Id: linux Crash Type: Use-of-uninitialized-value...

PT-2026-76139

libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.1, the uncompressed HEIF decoder validates explicit icef compressed-unit offsets using unit offset + unit size. Because the addition can wrap, a crafted HEIF file can pass the range check and then construct a vector...

CVE-2026-48029

libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.19.0 through 1.21.2 have a heap OOB read in ImageItemGrid::decodegridtile via irot-induced tile-coordinate underflow. Version 1.22.0 fixes the issue...

Updated libheif packages fix security vulnerabilities

libheif has a Heap OOB Read/SEGV Crash via Zero samplesperchunk. CVE-2026-32738 libheif is Vulnerable to Infinite Loop DoS via stts Sample Duration Lookup. CVE-2026-32739 Heap-Buffer-Overflow Write in Grid Tile Chroma Compositing. CVE-2026-32740 libheif has a heap buffer overflow in...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read in the uncompressed HEIF decoder process. An attacker can cause a crash by supplying a crafted HEIF file that manipulates compressed-unit offsets to trigger an out-of-bounds heap read. Remediation Upgrade libheif to...

CVE-2026-49271

libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.1, the uncompressed HEIF decoder validates explicit icef compressed-unit offsets using unitoffset + unitsize. Because the addition can wrap, a crafted HEIF file can pass the range check and then construct a vector...

CVE-2026-49271 libheif: Wrapped icef compressed-unit range check causes out-of-bounds read in uncompressed HEIF decoder

libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.1, the uncompressed HEIF decoder validates explicit icef compressed-unit offsets using unitoffset + unitsize. Because the addition can wrap, a crafted HEIF file can pass the range check and then construct a vector...

CVE-2026-49271: Out-of-bounds Read

libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.1, the uncompressed HEIF decoder validates explicit icef compressed-unit offsets using unitoffset + unitsize. Because the addition can wrap, a crafted HEIF file can pass the range check and then construct a vector...

graphicsmagick:coder_HEIF_fuzzer: Stack-buffer-underflow in vvdec::PU::xCheckSimilarMotion

Project: http://hg.code.sf.net/p/graphicsmagick/code Detailed Report: https://oss-fuzz.com/testcase?key=6303765310013440 Project: graphicsmagick Fuzzing Engine: honggfuzz Fuzz Target: coderHEIFfuzzer Job Type: honggfuzzasangraphicsmagick Platform Id: linux Crash Type: Stack-buffer-underflow READ ...

Libheif < 1.22.1 OOB Read (macOS)

According to its self-reported version, libheif prior to 1.22.1 is affected by an out-of-bounds read vulnerability. The uncompressed HEIF decoder validates explicit icef compressed-unit offsets using unitoffset + unitsize. Because the addition can wrap, a crafted HEIF file can pass the range chec...

kimageformats:kimgio_heif_fuzzer: Heap-use-after-free in slice_segment_header::operator=

Project: git://anongit.kde.org/kimageformats Detailed Report: https://oss-fuzz.com/testcase?key=4512093025140736 Project: kimageformats Fuzzing Engine: afl Fuzz Target: kimgioheiffuzzer Job Type: aflasankimageformats Platform Id: linux Crash Type: Heap-use-after-free READ 4 Crash Address:...

CVE-2026-32814

libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, when decoding a HEIF grid image with strictdecoding=false the default, a corrupted tile silently fails to decode and the library returns heiferrorOk with no indication of failure, leading to an uninitialized...

EUVD-2026-30972

libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and below, a crafted 792-byte HEIF sequence file with samplesperchunk=0 in the stsc box causes an unsigned integer underflow in the Chunk constructor mlastsample = 0 + 0 - 1 = UINT32MAX, mapping all samples to an empty...

SUSE CVE-2026-43906

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13.0, a heap-based buffer overflow in the HEIF decoder of OpenImageIO allows out-of-bounds writes via crafted images due to a subimage metada...