USN-8774-1 libheif vulnerabilities

Ali Firas discovered that libheif incorrectly handled certain images. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. CVE-2026-62291 Dmitrijs Trizna discovered that libheif incorrectly handled certain image sequences. An attacker could possibly us...

libheif-cve-2026-50142

CVE-2026-50142 — libheif HEIF 시퀀스 파서에서 무제한 힙 할당 stsz 고정 크기 모드 심각도: 높음 CVSS 7.5 권고: GHSA-jvmp-j3cw-84mh 수정됨: 커밋 a6caa38 by @farindk 수정 시간: 1시간 미만 요약 1,477바이트의 조작된 HEIF 파일이 Boxstsz::parse의 고정 크기 모드에서 maxsequenceframes 검사 누락으로 인해 Chunk::Chunk에서 약 7GB의 확인되지 않은 힙 할당을 유발합니다. 근본 원인 seqboxes.cc:1067 —...

Astra Linux – Vulnerability in libde265

A buffer overflow vulnerability in libheif 1.19.7 allows a local attacker to execute arbitrary code through the SAO Sample Adaptive Offset processing of libde265...

ROOT-OS-DEBIAN-12-CVE-2026-32738 CVE-2026-32738 in libheif - Patched by Root

Root has patched CVE-2026-32738 in the libheif package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-32814 CVE-2026-32814 in libheif - Patched by Root

Root has patched CVE-2026-32814 in the libheif package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-41071 CVE-2026-41071 in libheif - Patched by Root

Root has patched CVE-2026-41071 in the libheif package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2025-68431 CVE-2025-68431 in libheif - Patched by Root

Root has patched CVE-2025-68431 in the libheif package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-32740 CVE-2026-32740 in libheif - Patched by Root

Root has patched CVE-2026-32740 in the libheif package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-32882 CVE-2026-32882 in libheif - Patched by Root

Root has patched CVE-2026-32882 in the libheif package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-32739 CVE-2026-32739 in libheif - Patched by Root

Root has patched CVE-2026-32739 in the libheif package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-32741 CVE-2026-32741 in libheif - Patched by Root

Root has patched CVE-2026-32741 in the libheif package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-41069 CVE-2026-41069 in libheif - Patched by Root

Root has patched CVE-2026-41069 in the libheif package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2023-49463 CVE-2023-49463 in libheif - Patched by Root

Root has patched CVE-2023-49463 in the libheif package for Root:Debian:12. Multiple fixed versions available...

Astro: Remote code execution through AVIF image optimization

A vulnerability in libheif, used by the default Sharp image service in Astro, can lead to remote code execution when a malicious AVIF image is optimized. Projects are affected when an attacker can cause Astro to process an untrusted AVIF image. The fix was released in Astro 7.2.8, which requires...

sharp: Vulnerabilities in libheif: GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545

Impact A number of vulnerabilities, two rated as "Critical" severity using CVSSv3, have been discovered and fixed in the upstream libheif dependency. These can lead to possible remote code execution RCE on glibc-based Linux when run under certain conditions. The attack vector for these claims to ...

Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used

A vulnerability in the underlying libheif library used by sharp which Next.js uses for image optimization can lead to remote code execution when AVIF files are optimized. Until a fix has propagated, optimization of AVIF files is disabled...

OPENSUSE-SU-2026:11719-1 gdk-pixbuf-loader-libheif-1.23.4-1.1 on GA media

These are all security issues fixed in the gdk-pixbuf-loader-libheif-1.23.4-1.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-89112

🚨NextJS, Sharp and ImagicMagick affected by Critical libheif vulnerability 🚨 A heap buffer overflow CVE-2026-84383 in libheif along with 10 other vulnerabilities has been reported to result in RCE when parsing malformed HEIC/HEIF/AVIF images. Popular web tools parsing AVIFS like @nextjs and sharp...

[SECURITY] Fedora 45 Update: libheif-1.23.3-2.fc45

libheif is an ISO/IEC 23008-12:2017 HEIF and AVIF AV1 Image File Format file format decoder and encoder...

Linux Distros Unpatched Vulnerability : CVE-2026-84451

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - libheif - None Ubuntu Linux - Incomplete fix for GHSA-73p7-m7gg-w2jv leaves libheif 1.23.1 vulnerable to an out-of-bounds read CVE-2026-84451 Not...