CVE-2021-32287

An issue was discovered in heif through v3.6.2. A global-buffer-overflow exists in the function HevcDecoderConfigurationRecord::getPicWidth located in hevcdecoderconfigrecord.cpp. It allows an attacker to cause code Execution...

libheif 代码问题漏洞

libheif is an ISO/IEC 23008-12:2017 HEIF file format decoder and encoder from struktur open source. A code issue vulnerability exists in libheif versions prior to 1.19.6 that stems from a null pointer dereference in the ImageItemiden function in image-items/iden.cc...

UBUNTU-CVE-2025-29769

libvips is a demand-driven, horizontally threaded image processing library. The heifsave operation could incorrectly determine the presence of an alpha channel in an input when it was not possible to determine the colour interpretation, known internally within libvips as "multiband". There aren't...

CVE-2025-29769 libvips has a potential heap-based buffer overflow when attempting to convert multiband TIFF input to HEIF output

libvips is a demand-driven, horizontally threaded image processing library. The heifsave operation could incorrectly determine the presence of an alpha channel in an input when it was not possible to determine the colour interpretation, known internally within libvips as "multiband". There aren't...

CVE-2025-29769

CVE-2025-29769 affects libvips, where the heifsave path could mis-handle a multiband TIFF input (4 channels) and output HEIF with 3 channels, then attempt to write 4 channels, causing a heap-based buffer overflow and possible crash. Root cause: incorrect alpha-channel determination when colour in...

CVE-2025-29769 libvips has a potential heap-based buffer overflow when attempting to convert multiband TIFF input to HEIF output

libvips is a demand-driven, horizontally threaded image processing library. The heifsave operation could incorrectly determine the presence of an alpha channel in an input when it was not possible to determine the colour interpretation, known internally within libvips as "multiband". There aren't...

CVE-2025-29769 libvips has a potential heap-based buffer overflow when attempting to convert multiband TIFF input to HEIF output

libvips is a demand-driven, horizontally threaded image processing library. The heifsave operation could incorrectly determine the presence of an alpha channel in an input when it was not possible to determine the colour interpretation, known internally within libvips as "multiband". There aren't...

GHSA-M5QC-5HW7-8VG7 image-size Denial of Service via Infinite Loop during Image Processing

Summary image-size is vulnerable to a Denial of Service vulnerability when processing specially crafted images. The issue occurs because of an infine loop in findBox when processing certain images with a box with size 0. Details If the first bytes of the input does not match any bytes in...

PT-2025-8948 · Apple · Ios +2

Name of the Vulnerable Software and Affected Versions: iOS version 18.2.1 Description: A zero-click attack on an iOS device leverages a vulnerability in Core Media, allowing attackers to deliver a malicious iMessage containing a specially crafted HEIF image. The exploit bypasses Apple’s BlastDoor...

PT-2025-11133 · Git +1 · Libvips

Name of the Vulnerable Software and Affected Versions: libvips affected versions not specified Description: The software contains a heap-buffer-overflow write issue occurring within the vips foreign save heif write block function, triggered during wbuffer write thread and vips threadset work...

[SECURITY] Fedora 41 Update: libheif-1.19.5-3.fc41

libheif is an ISO/IEC 23008-12:2017 HEIF and AVIF AV1 Image File Format file format decoder and encoder...

[SECURITY] Fedora 40 Update: libheif-1.19.5-3.fc40

libheif is an ISO/IEC 23008-12:2017 HEIF and AVIF AV1 Image File Format file format decoder and encoder...

Fedora 40 : libheif (2025-666aaa6a0d)

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-666aaa6a0d advisory. Latest upstream release. It adds support for tiles and fixes reading images generated by iOS 18+. See https://github.com/strukturag/libheif/releases for more...

CVE-2017-13318

In HeifDataSource::readAt of HeifDecoderImpl.cpp, there is a possible out of bounds read due to an integer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation...

Astra Linux - Vulnerability in libheif

A segmentation fault caused by a floating-point exception exists in libheif 1.15.1 when using specially crafted HEIF images via the heif::Fraction::round function in box.cc, which results in a denial of service...

Updated libheif packages fix security vulnerability

In Libheif, insufficient checks in ImageOverlay::parse while decoding a HEIF file containing an overlay image with forged offsets can lead to an out-of-bounds read and write. CVE-2024-41311...

[SECURITY] [DLA 3945-1] libheif security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3945-1 [email protected] https://www.debian.org/lts/security/ Chris Lamb November 05, 2024 https://wiki.debian.org/LTS -...

USN-7082-1 libheif vulnerability

Gerrard Tai discovered that libheif did not properly validate certain images, leading to out-of-bounds read and write vulnerability. If a user or automated system were tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a denial of service or to obtai...

SUSE CVE-2024-40630

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation via a format-agnostic API with a feature set, scalability, and robustness needed for feature film production. In affected versions there is a bug in the heif input...

Out-of-bounds Read

OpenImageIO is vulnerable to Out-of-bounds Read. The vulnerability is due to a bug in the heif input functionality, specifically in HeifInput::seeksubimage, which can potentially lead to information disclosure when using the ImageInput APIs...