CVE-2026-84383: Out-of-bounds Write

libheif is a HEIF and AVIF file format decoder and encoder. From 1.22.0 until 1.23.2, a crafted HEIF, HEIC, or AVIF item graph using nested iden and auxl references can make HeifPixelImage::transferchannelfromimageas append duplicate Alpha planes with different bit depths to mstorage...

The vulnerability of the HeifPixelImage::copy_image_to() function in the libheif/pixelimage.cc decoder and file format parser allows a hacker to execute arbitrary code.

The vulnerability of the HeifPixelImage::copyimageto function in the libheif/pixelimage.cc decoder and file format parser is related to writing beyond the buffer boundaries in memory. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

CVE-2026-32882: Out-of-bounds Read

libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.21.2 and prior contain a heap buffer over-read in HeifPixelImage::overlay in libheif/pixelimage.cc. When compositing an overlay image iovl whose child image has a different bit depth for the alpha channel than for the color...

PT-2026-36267

libheif is an HEIF and AVIF file format decoder and encoder. Prior to version 1.21.0, a crafted HEIF that exercises the overlay image item path triggers a heap buffer over-read in HeifPixelImage::overlay. The function computes a negative row length likely from an unclipped overlay rectangle or...

Security update for libheif

This update for libheif fixes the following issues: CVE-2025-68431: Fixed heap buffer over-read in HeifPixelImage::overlay via crafted HEIF that exercises the overlay image item bsc1255735 Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST...

Security update for libheif (moderate)

openSUSE security update: security update for libheif ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:20076-1 Rating: moderate References: bsc1255735 Cross-References: CVE-2025-68431 CVSS scores: CVE-2025-68431 SUSE : 5.5...

SUSE-SU-2026:20121-1 Security update for libheif

This update for libheif fixes the following issues: - CVE-2025-68431: heap buffer over-read in HeifPixelImage::overlay via crafted HEIF file that exercises the overlay image item path bsc1255735...

libheif:file_fuzzer: Negative-size-param in HeifPixelImage::fill_RGB_16bit

Project: https://github.com/strukturag/libheif.git Detailed Report: https://oss-fuzz.com/testcase?key=4782198220980224 Project: libheif Fuzzing Engine: libFuzzer Fuzz Target: filefuzzer Job Type: libfuzzerasani386libheif Platform Id: linux Crash Type: Negative-size-param Crash Address: Crash Stat...

Security update for libheif

This update for libheif fixes the following issues: CVE-2025-68431: Fixed heap buffer over-read in HeifPixelImage::overlay via crafted HEIF that exercises the overlay image item bsc1255735 Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST...

CVE-2025-68431: Out-of-bounds Read

libheif is an HEIF and AVIF file format decoder and encoder. Prior to version 1.21.0, a crafted HEIF that exercises the overlay image item path triggers a heap buffer over-read in HeifPixelImage::overlay. The function computes a negative row length likely from an unclipped overlay rectangle or...

libheif:file_fuzzer: Memcpy-param-overlap in HeifPixelImage::overlay

Project: https://github.com/strukturag/libheif.git Detailed Report: https://oss-fuzz.com/testcase?key=6093792387334144 Project: libheif Fuzzing Engine: honggfuzz Fuzz Target: filefuzzer Job Type: honggfuzzasanlibheif Platform Id: linux Crash Type: Memcpy-param-overlap Crash Address:...

libheif:file_fuzzer: Crash in HeifPixelImage::overlay

Project: https://github.com/strukturag/libheif.git Detailed Report: https://oss-fuzz.com/testcase?key=4759237937135616 Project: libheif Fuzzing Engine: libFuzzer Fuzz Target: filefuzzer Job Type: libfuzzerubsanlibheif Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x5565238db003 Crash...

libheif:file_fuzzer: Crash in HeifPixelImage::overlay

Project: https://github.com/strukturag/libheif.git Detailed Report: https://oss-fuzz.com/testcase?key=5112307316752384 Project: libheif Fuzzing Engine: libFuzzer Fuzz Target: filefuzzer Job Type: libfuzzerubsanlibheif Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x7a01d6971182 Crash...

libheif:file_fuzzer: Heap-buffer-overflow in HeifPixelImage::fill_RGB_16bit

Project: https://github.com/strukturag/libheif.git Detailed Report: https://oss-fuzz.com/testcase?key=5031427882680320 Project: libheif Fuzzing Engine: afl Fuzz Target: filefuzzer Job Type: aflasanlibheif Platform Id: linux Crash Type: Heap-buffer-overflow WRITE Crash Address: 0x52900155828f Cras...

libheif:file_fuzzer: Heap-use-after-free in HeifPixelImage::overlay

Project: https://github.com/strukturag/libheif.git Detailed Report: https://oss-fuzz.com/testcase?key=4706741804138496 Project: libheif Fuzzing Engine: afl Fuzz Target: filefuzzer Job Type: aflasanlibheif Platform Id: linux Crash Type: Heap-use-after-free READ 14 Crash Address: 0x7dfdc186d801 Cra...

imagemagick:encoder_heic_fuzzer: Heap-buffer-overflow in HeifPixelImage::overlay

Project: https://github.com/imagemagick/imagemagick.git Detailed Report: https://oss-fuzz.com/testcase?key=4849915344257024 Project: imagemagick Fuzzing Engine: honggfuzz Fuzz Target: encoderheicfuzzer Job Type: honggfuzzasanimagemagick Platform Id: linux Crash Type: Heap-buffer-overflow READ Cra...

libheif:file_fuzzer: Heap-buffer-overflow in HeifPixelImage::fill_RGB_16bit

Project: https://github.com/strukturag/libheif.git Detailed Report: https://oss-fuzz.com/testcase?key=4784059989950464 Project: libheif Fuzzing Engine: libFuzzer Fuzz Target: filefuzzer Job Type: libfuzzerasanlibheif Platform Id: linux Crash Type: Heap-buffer-overflow WRITE Crash Address:...

libheif:file_fuzzer: Crash in HeifPixelImage::overlay

Project: https://github.com/strukturag/libheif.git Detailed Report: https://oss-fuzz.com/testcase?key=5072436592508928 Project: libheif Fuzzing Engine: afl Fuzz Target: filefuzzer Job Type: aflasanlibheif Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x453de8a42800 Crash State:...

OSV-2020-1260 Negative-size-param in heif::HeifPixelImage::fill_RGB_16bit

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13563 Crash type: Negative-size-param Crash state: heif::HeifPixelImage::fillRGB16bit heif::HeifContext::decodeoverlayimage heif::HeifContext::decodeimage...

PT-2020-21796

Name of the Vulnerable Software and Affected Versions heif affected versions not specified Description A crash occurs due to a negative-size-param issue. The crash happens in the heif::HeifPixelImage::fill RGB 16bit function, which is called by heif::HeifContext::decode overlay image and...