CVE-2026-84383: Out-of-bounds Write

libheif is a HEIF and AVIF file format decoder and encoder. From 1.22.0 until 1.23.2, a crafted HEIF, HEIC, or AVIF item graph using nested iden and auxl references can make HeifPixelImage::transferchannelfromimageas append duplicate Alpha planes with different bit depths to mstorage...

CVE-2026-84450: Reachable Assertion

libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.3, a crafted image item containing a clap property and an ispe width or height greater than INT32MAX + 1 can reach crop calculations through heifimagehandlegetimagetiling. Boxclap::leftrounded or Boxclap::toprounde...

CVE-2026-84448: Out-of-bounds Read

libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, the public heifregionitemaddregioninlinemaskdata function in libheif/api/libheif/heifregions.cc accepts maskdatalen without verifying that it equals the byte count required by width and height. A later...

CVE-2026-84446: Loop with Unreachable Exit Condition

libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, crafted HEIF sequence timing and edit-list data can make Track::initsampletimingtable compute a logical mnumoutputsamples value that exceeds the uint32t counters used by TrackVisual::decodenextimagesample and...

CVE-2026-84447: Allocation of Resources Without Limits or Throttling

libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.1 and earlier, crafted grid, iovl, and iden reference graphs can repeatedly decode the same base image because processedids is copied per branch and ImageItem::decodeimage has no shared operation budget. This vulnerability is fix...

CVE-2026-84450: Reachable Assertion

libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.3, a crafted image item containing a clap property and an ispe width or height greater than INT32MAX + 1 can reach crop calculations through heifimagehandlegetimagetiling. Boxclap::leftrounded or Boxclap::toprounde...

PT-2026-95480

Name of the Vulnerable Software and Affected Versions libheif versions prior to 1.19.6 Description An integer overflow occurs in the Op RGB24 32 to YCbCr::convert colorspace function when processing extremely large RGB images created via heif image create and heif image add plane. This overflow...

CVE-2026-84384: Improper Handling of Highly Compressed Data (Data Amplification)

libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.2, crafted HEIF or AVIF mime metadata and unci image data can cause decompressbrotli and doinflate to grow accumulated output without an effective size limit or MemoryHandle accounting. The brotli path has no outpu...

CVE-2026-84451: Out-of-bounds Read

libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.3, the no-icef full-item branch of uncdecoder::getcompressedimagedatauncompressed in libheif/codecs/uncompressed/uncdecoder.cc retains an addition-based range check that can wrap when a crafted uncompressed tile gr...

CVE-2026-84449: Integer Overflow or Wraparound

libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.19.6, OpRGB2432toYCbCr::convertcolorspace stores image-plane strides in an integer width that can overflow for extremely large RGB images created through heifimagecreate and heifimageaddplane. The resulting wrapped stride caus...

Fedora 45 : libheif (2026-73d31ad4c6)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-73d31ad4c6 advisory. Latest security bugfix release from upstream. Changes: https://github.com/strukturag/libheif/releases/tag/v1.23.4 . Resolves 3 high impact and 3 medium impac...

Libheif 1.22.x < 1.23.2 Heap Buffer Overflow (macOS)

According to its self-reported version, libheif on the remote host is 1.22.0 or later and prior to 1.23.2. It is, therefore, affected by a heap buffer overflow vulnerability. A crafted HEIC/HEIF/AVIF file using nested identity derivation iden and auxiliary auxl item references causes...

Ubuntu 26.04 LTS : libheif vulnerabilities (USN-8774-1)

The remote Ubuntu 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8774-1 advisory. Ali Firas discovered that libheif incorrectly handled certain images. An attacker could possibly use this issue to cause a denial of service or execute...

USN-8774-1 libheif vulnerabilities

Ali Firas discovered that libheif incorrectly handled certain images. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. CVE-2026-62291 Dmitrijs Trizna discovered that libheif incorrectly handled certain image sequences. An attacker could possibly us...

USN-8774-1: libheif vulnerabilities

Ali Firas discovered that libheif incorrectly handled certain images. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. CVE-2026-62291 Dmitrijs Trizna discovered that libheif incorrectly handled certain image sequences. An attacker could possibly us...

Astra Linux – Vulnerability in libheif

libheif is a decoder and encoder for HEIF and AVIF file formats. In versions 1.23.0 and earlier, a crafted HEIF sequence accepted by heifcontextreadfrommemory could cause the context to have no registered sequence tracks, leading to a crash when heifcontextgettrackctx, 0 was called. The...

Astra Linux – Vulnerability in libheif

There is a vulnerability in the strided image data parsing code in the emscripten wrapper for libheif. An attacker could exploit this through a crafted image file to cause a buffer overflow in linear memory during a memcpy call...

Astra Linux – Vulnerability in libheif

libheif is a decoder and encoder for HEIF and AVIF file formats. In versions 1.23.0 and earlier, a specially crafted image sequence with a 2x2 primary plane and a 256x256 auxiliary alpha plane could cause heap corruption under normal decode and re-encode processes. The...

Medium: libheif

Issue Overview: libheif: Integer underflow in Fraction constructor via double clap transform application CVE-2026-62289 libheif: Out-of-bounds read in uncompressed unci tile range slicing CVE-2026-62292 Affected Packages: libheif Issue Correction: Run dnf update libheif --releasever...

Amazon Linux 2023 : heif-pixbuf-loader, libheif, libheif-devel (ALAS2023-2026-2134)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2134 advisory. libheif: Integer underflow in Fraction constructor via double clap transform application CVE-2026-62289 libheif: Out-of-bounds read in uncompressed unci tile range slicing CVE-2026-62292 Tenab...