CVE-2026-84448

libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, the public heifregionitemaddregioninlinemaskdata function in libheif/api/libheif/heifregions.cc accepts maskdatalen without verifying that it equals the byte count required by width and height. A later...

CVE-2026-84447

libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.1 and earlier, crafted grid, iovl, and iden reference graphs can repeatedly decode the same base image because processedids is copied per branch and ImageItem::decodeimage has no shared operation budget. This vulnerability is fix...

CVE-2026-84449

libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.19.6, OpRGB2432toYCbCr::convertcolorspace stores image-plane strides in an integer width that can overflow for extremely large RGB images created through heifimagecreate and heifimageaddplane. The resulting wrapped stride caus...

CVE-2026-84451

libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.3, the no-icef full-item branch of uncdecoder::getcompressedimagedatauncompressed in libheif/codecs/uncompressed/uncdecoder.cc retains an addition-based range check that can wrap when a crafted uncompressed tile gr...

UBUNTU-CVE-2026-84447

libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.1 and earlier, crafted grid, iovl, and iden reference graphs can repeatedly decode the same base image because processedids is copied per branch and ImageItem::decodeimage has no shared operation budget. This vulnerability is fix...

UBUNTU-CVE-2026-84384

libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.2, crafted HEIF or AVIF mime metadata and unci image data can cause decompressbrotli and doinflate to grow accumulated output without an effective size limit or MemoryHandle accounting. The brotli path has no outpu...

CVE-2026-84450

libheif versions 1.19.0 through 1.23.3 are affected by a crafted-image vulnerability in the tiling API. A HEIF/AVIF image containing a clap property with an ispe width or height exceeding INT32_MAX + 1 triggers crop calculations via heif_image_handle_get_image_tiling(). The Fraction::Fraction() u...

EUVD-2026-83028

libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.3, a crafted image item containing a clap property and an ispe width or height greater than INT32MAX + 1 can reach crop calculations through heifimagehandlegetimagetiling. Boxclap::leftrounded or Boxclap::toprounde...

CVE-2026-84450 libheif: `clap` + oversized `ispe` aborts on an assert in `Fraction::Fraction` (incomplete fix for CVE-2026-62289)

libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.3, a crafted image item containing a clap property and an ispe width or height greater than INT32MAX + 1 can reach crop calculations through heifimagehandlegetimagetiling. Boxclap::leftrounded or Boxclap::toprounde...

CVE-2026-84450 libheif: `clap` + oversized `ispe` aborts on an assert in `Fraction::Fraction` (incomplete fix for CVE-2026-62289)

libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.3, a crafted image item containing a clap property and an ispe width or height greater than INT32MAX + 1 can reach crop calculations through heifimagehandlegetimagetiling. Boxclap::leftrounded or Boxclap::toprounde...

CVE-2026-84450

libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.3, a crafted image item containing a clap property and an ispe width or height greater than INT32MAX + 1 can reach crop calculations through heifimagehandlegetimagetiling. Boxclap::leftrounded or Boxclap::toprounde...

CVE-2026-84450 libheif: `clap` + oversized `ispe` aborts on an assert in `Fraction::Fraction` (incomplete fix for CVE-2026-62289)

libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.3, a crafted image item containing a clap property and an ispe width or height greater than INT32MAX + 1 can reach crop calculations through heifimagehandlegetimagetiling. Boxclap::leftrounded or Boxclap::toprounde...

CVE-2026-84449 libheif hOp_RGB24_32_to_YCbCr Memory Access Error / SEGV

libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.19.6, OpRGB2432toYCbCr::convertcolorspace stores image-plane strides in an integer width that can overflow for extremely large RGB images created through heifimagecreate and heifimageaddplane. The resulting wrapped stride caus...

CVE-2026-84449 libheif hOp_RGB24_32_to_YCbCr Memory Access Error / SEGV

libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.19.6, OpRGB2432toYCbCr::convertcolorspace stores image-plane strides in an integer width that can overflow for extremely large RGB images created through heifimagecreate and heifimageaddplane. The resulting wrapped stride caus...

CVE-2026-84449

libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.19.6, OpRGB2432toYCbCr::convertcolorspace stores image-plane strides in an integer width that can overflow for extremely large RGB images created through heifimagecreate and heifimageaddplane. The resulting wrapped stride caus...

CVE-2026-84449 libheif hOp_RGB24_32_to_YCbCr Memory Access Error / SEGV

libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.19.6, OpRGB2432toYCbCr::convertcolorspace stores image-plane strides in an integer width that can overflow for extremely large RGB images created through heifimagecreate and heifimageaddplane. The resulting wrapped stride caus...

CVE-2026-84449

libheif (HEIF/AVIF encoder/decoder) is affected by an integer overflow in Op_RGB24_32_to_YCbCr::convert_colorspace() (prior to v1.19.6). When extremely large RGB images are created via heif_image_create() and heif_image_add_plane(), the image-plane stride stored in an integer width can overflow. ...

EUVD-2026-83025

libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.19.6, OpRGB2432toYCbCr::convertcolorspace stores image-plane strides in an integer width that can overflow for extremely large RGB images created through heifimagecreate and heifimageaddplane. The resulting wrapped stride caus...

CVE-2026-84451 libheif: Incomplete fix for CVE-2026-62292 leaves libheif vulnerable to an out-of-bounds read

libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.3, the no-icef full-item branch of uncdecoder::getcompressedimagedatauncompressed in libheif/codecs/uncompressed/uncdecoder.cc retains an addition-based range check that can wrap when a crafted uncompressed tile gr...

CVE-2026-84451 libheif: Incomplete fix for CVE-2026-62292 leaves libheif vulnerable to an out-of-bounds read

libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.3, the no-icef full-item branch of uncdecoder::getcompressedimagedatauncompressed in libheif/codecs/uncompressed/uncdecoder.cc retains an addition-based range check that can wrap when a crafted uncompressed tile gr...