USN-8774-1 libheif vulnerabilities

Ali Firas discovered that libheif incorrectly handled certain images. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. CVE-2026-62291 Dmitrijs Trizna discovered that libheif incorrectly handled certain image sequences. An attacker could possibly us...

libheif-cve-2026-50142

CVE-2026-50142 — libheif HEIFシーケンスパーサーにおける無制限のヒープ割り当て stsz固定サイズモード 深刻度: 高 CVSS 7.5 アドバイザリ: GHSA-jvmp-j3cw-84mh 修正: コミット a6caa38 by @farindk 修正時間: 1時間未満 概要 1,477バイトの細工されたHEIFファイルが、Boxstsz::parseの固定サイズモードにおけるmaxsequenceframesチェック欠如を介して、Chunk::Chunk内で約7 GBの未チェックのヒープ割り当てを引き起こす。 根本原因 seqboxes.cc:1067 ...

Astra Linux – Vulnerability in libde265

A buffer overflow vulnerability in libheif 1.19.7 allows a local attacker to execute arbitrary code through the SAO Sample Adaptive Offset processing of libde265...

ROOT-OS-DEBIAN-12-CVE-2026-41071 CVE-2026-41071 in libheif - Patched by Root

Root has patched CVE-2026-41071 in the libheif package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-32738 CVE-2026-32738 in libheif - Patched by Root

Root has patched CVE-2026-32738 in the libheif package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-32814 CVE-2026-32814 in libheif - Patched by Root

Root has patched CVE-2026-32814 in the libheif package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-32882 CVE-2026-32882 in libheif - Patched by Root

Root has patched CVE-2026-32882 in the libheif package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2025-68431 CVE-2025-68431 in libheif - Patched by Root

Root has patched CVE-2025-68431 in the libheif package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-32740 CVE-2026-32740 in libheif - Patched by Root

Root has patched CVE-2026-32740 in the libheif package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2023-49463 CVE-2023-49463 in libheif - Patched by Root

Root has patched CVE-2023-49463 in the libheif package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-32741 CVE-2026-32741 in libheif - Patched by Root

Root has patched CVE-2026-32741 in the libheif package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-32739 CVE-2026-32739 in libheif - Patched by Root

Root has patched CVE-2026-32739 in the libheif package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-41069 CVE-2026-41069 in libheif - Patched by Root

Root has patched CVE-2026-41069 in the libheif package for Root:Debian:12. Multiple fixed versions available...

Astro: Remote code execution through AVIF image optimization

A vulnerability in libheif, used by the default Sharp image service in Astro, can lead to remote code execution when a malicious AVIF image is optimized. Projects are affected when an attacker can cause Astro to process an untrusted AVIF image. The fix was released in Astro 7.2.8, which requires...

sharp: Vulnerabilities in libheif: GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545

Impact A number of vulnerabilities, two rated as "Critical" severity using CVSSv3, have been discovered and fixed in the upstream libheif dependency. These can lead to possible remote code execution RCE on glibc-based Linux when run under certain conditions. The attack vector for these claims to ...

Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used

A vulnerability in the underlying libheif library used by sharp which Next.js uses for image optimization can lead to remote code execution when AVIF files are optimized. Until a fix has propagated, optimization of AVIF files is disabled...

OPENSUSE-SU-2026:11719-1 gdk-pixbuf-loader-libheif-1.23.4-1.1 on GA media

These are all security issues fixed in the gdk-pixbuf-loader-libheif-1.23.4-1.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-89112

🚨NextJS, Sharp and ImagicMagick affected by Critical libheif vulnerability 🚨 A heap buffer overflow CVE-2026-84383 in libheif along with 10 other vulnerabilities has been reported to result in RCE when parsing malformed HEIC/HEIF/AVIF images. Popular web tools parsing AVIFS like @nextjs and sharp...

[SECURITY] Fedora 45 Update: libheif-1.23.3-2.fc45

libheif is an ISO/IEC 23008-12:2017 HEIF and AVIF AV1 Image File Format file format decoder and encoder...

Linux Distros Unpatched Vulnerability : CVE-2026-84450

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - libheif - None Ubuntu Linux - Incomplete fix for GHSA-73p7-m7gg-w2jv leaves libheif 1.23.1 vulnerable to an out-of-bounds read CVE-2026-84450 Not...