CVE-2025-62821

Microsoft HEIF Image Extensions msheifstore.dll: CopyPixels 경로에서 소스 버퍼 미할당으로 인한 범위 초과 읽기 및 액세스 위반 DoS WIC를 통해 조작된 HEIF 이미지를 디코딩할 때, msheif 코덱은 1바이트 소스 버퍼를 할당하지만 이후 CopyPixels 중에 해당 버퍼에서 매우 많은 양의 픽셀 데이터를 복사하려고 시도합니다. 복사는 stride × ROI 높이에서 파생된 크기로 memmove를 사용하며, 소스 버퍼의 실제 길이를 검증하지 않습니다. 이로 인해 범위 초과...

CVE-2026-62377

A flaw was found in libheif, a HEIF and AVIF file format decoder and encoder. A remote attacker could provide a specially crafted HEIF sequence. Processing this malicious file could lead to a reachable assertion or dereference an empty map, resulting in a crash of the application. This...

CVE-2026-62289

A flaw was found in libheif, a HEIF and AVIF file format decoder and encoder. A remote attacker could exploit this vulnerability by providing a specially crafted HEIF or AVIF file containing a clean aperture box. This can lead to an integer underflow when processing image transformations, causing...

CVE-2026-50142

A flaw was found in libheif, a HEIF and AVIF file format decoder and encoder. A remote attacker can provide a specially crafted HEIF sequence that triggers an unbounded heap allocation. This occurs because the HEIF sequence parser's fixed-size mode is missing a bound check, and an integer...

CVE-2026-62377

libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF sequence accepted by heifcontextreadfrommemory can leave the context with no registered sequence tracks and crash when heifcontextgettrackctx, 0 is called. HeifContext::gettrack in libheif/context.cc...

Linux Distros Unpatched Vulnerability : CVE-2026-62377

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF sequence accepted by heifcontextreadfrommemory can leave the...

CVE-2026-62292

libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.1, a crafted uncompressed HEIF image using generic zlib unci full-item compression can crash an application that decodes an advertised tile with heifimagehandledecodeimagetile. In...

CVE-2026-62377

libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF sequence accepted by heifcontextreadfrommemory can leave the context with no registered sequence tracks and crash when heifcontextgettrackctx, 0 is called. HeifContext::gettrack in libheif/context.cc...

DEBIAN-CVE-2026-62377

libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF sequence accepted by heifcontextreadfrommemory can leave the context with no registered sequence tracks and crash when heifcontextgettrackctx, 0 is called. HeifContext::gettrack in libheif/context.cc...

CVE-2026-62291

libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted image sequence with a 2x2 primary plane and a 256x256 auxiliary alpha plane can cause attacker-controlled heap corruption during a normal decode and re-encode workflow. TrackVisual::decodenextimagesample...

CVE-2026-50142

libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.0, a crafted HEIF sequence accepted by heifcontextreadfrommemory with the msf1 sequence brand can cause unbounded heap allocation. In libheif/sequences/seqboxes.cc, Boxstsz::parse applies maxsequenceframes only to...

CVE-2026-62377 libheif: Reachable assertion in HeifContext::get_track() aborts on a valid-but-empty HEIF sequence file (context.cc:2110)

libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF sequence accepted by heifcontextreadfrommemory can leave the context with no registered sequence tracks and crash when heifcontextgettrackctx, 0 is called. HeifContext::gettrack in libheif/context.cc...

EUVD-2026-62191

libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF sequence accepted by heifcontextreadfrommemory can leave the context with no registered sequence tracks and crash when heifcontextgettrackctx, 0 is called. HeifContext::gettrack in libheif/context.cc...

CVE-2026-62377

libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF sequence accepted by heifcontextreadfrommemory can leave the context with no registered sequence tracks and crash when heifcontextgettrackctx, 0 is called. HeifContext::gettrack in libheif/context.cc...

CVE-2026-62377 libheif: Reachable assertion in HeifContext::get_track() aborts on a valid-but-empty HEIF sequence file (context.cc:2110)

libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF sequence accepted by heifcontextreadfrommemory can leave the context with no registered sequence tracks and crash when heifcontextgettrackctx, 0 is called. HeifContext::gettrack in libheif/context.cc...

CVE-2026-62292 libheif: Out-of-bounds read in uncompressed unci tile range slicing

libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.1, a crafted uncompressed HEIF image using generic zlib unci full-item compression can crash an application that decodes an advertised tile with heifimagehandledecodeimagetile. In...

EUVD-2026-62188

libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF or AVIF file containing a clean aperture box can reduce an image dimension to zero and crash or corrupt tiling results when heifimagehandlegetimagetilinghandle, 1, &tiling is called...

CVE-2026-50142

libheif 1.19.0–1.23.0 is vulnerable to denial-of-service via crafted HEIF sequences: Box_stsz::parse() omits bound checks in fixed-size mode, and Track::load() 32-bit arithmetic wraparound bypasses consistency checks, allowing multi-gigabyte allocations. No in-the-wild exploitation reported. Fixe...

CVE-2026-50142 libheif: unbounded heap allocation in HEIF sequence parser (stsz fixed-size mode missing bound check)

libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.0, a crafted HEIF sequence accepted by heifcontextreadfrommemory with the msf1 sequence brand can cause unbounded heap allocation. In libheif/sequences/seqboxes.cc, Boxstsz::parse applies maxsequenceframes only to...

EUVD-2026-62187

libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.0, a crafted HEIF sequence accepted by heifcontextreadfrommemory with the msf1 sequence brand can cause unbounded heap allocation. In libheif/sequences/seqboxes.cc, Boxstsz::parse applies maxsequenceframes only to...