1033 matches found
Fedora 45 : libheif (2026-a7307e699c)
The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-a7307e699c advisory. Latest upstream security fix release. Changes: https://github.com/strukturag/libheif/releases/tag/v1.23.3 . Tenable has extracted the preceding description...
Security update for libheif
This update for libheif fixes the following issue: CVE-2026-62289: integer underflow in Fraction constructor via double clap transform application bsc1273079. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...
Linux Distros Unpatched Vulnerability : CVE-2026-84450
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.3, a crafted image item containing a clap property and an ispe width or heigh...
Linux Distros Unpatched Vulnerability : CVE-2026-84451
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.3, the no-icef full- item branch of...
UBUNTU-CVE-2026-84450
Incomplete fix for GHSA-73p7-m7gg-w2jv leaves libheif 1.23.1 vulnerable to an out-of-bounds read...
UBUNTU-CVE-2026-84451
Incomplete fix for GHSA-73p7-m7gg-w2jv leaves libheif 1.23.1 vulnerable to an out-of-bounds read...
PT-2026-89118
Name of the Vulnerable Software and Affected Versions libheif versions 1.19.0 through 1.23.2 Description A crafted image item containing a clap property and an ispe width or height greater than INT32 MAX + 1 can reach crop calculations through the heif image handle get image tiling function. The...
PT-2026-89119
Name of the Vulnerable Software and Affected Versions libheif versions 1.19.0 through 1.23.2 Description An integer overflow occurs in the unc decoder::get compressed image data uncompressed function within the no-icef full-item branch. This happens when a crafted uncompressed tile grid provides ...
PT-2026-107722
Уязвимость компонента unci декодера и кодировщика форматов файлов libheif связана с записью за границами буфера в памяти. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, выполнить произвольный код...
openSUSE 16: gdk-pixbuf-loader-libheif / libheif-aom / libheif-dav1d / etc (openSUSE-SU-2026:21644-1)
The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21644-1 advisory. Update to version 1.23.1 jscPED-16355. Security issues fixed: - CVE-2026-62289: integer underflow in Fraction constructor via double clap...
WS-2026-0060
A number of vulnerabilities, two rated critical, have been discovered and fixed in the upstream libheif dependency bundled by sharp. These can lead to possible remote code execution on glibc-based Linux when processing untrusted input. sharp before 0.35.4 bundles libheif 1.23.1 or earlier; 0.35.4...
USN-8683-1: libheif vulnerabilities
Feng Ning discovered that libheif incorrectly handled certain image transforms. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. CVE-2026-62289 Ali Firas discovered that libheif...
USN-8683-1 libheif vulnerabilities
Feng Ning discovered that libheif incorrectly handled certain image transforms. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. CVE-2026-62289 Ali Firas discovered that libheif...
Insecure Automated Optimizations
Overview next is a react framework. Affected versions of this package are vulnerable to Insecure Automated Optimizations through the image-optimizer path in packages/next/src/server/image-optimizer.ts. An attacker can execute code in the server-side image optimization process by supplying an AVIF...
Out-of-bounds Write
Overview Affected versions of this package are vulnerable to Out-of-bounds Write through ImageItem::decodeimage in libheif/image-items/imageitem.cc. An attacker can trigger memory corruption by supplying a malformed HEIC image with mismatched alpha-plane geometry that is decoded and scaled agains...
Heap-based Buffer Overflow
Overview Affected versions of this package are vulnerable to Heap-based Buffer Overflow due to duplicate Alpha planes in HeifPixelImage::transferchannelfromimageas and scalenearestneighbor in libheif/image/pixelimage.cc and libheif/image-items/imageitem.cc. An attacker can trigger an out-of-bound...
OPENSUSE-SU-2026:21644-1 Security update for libheif
This update for libheif fixes the following issues: Update to version 1.23.1 jscPED-16355. Security issues fixed: - CVE-2026-62289: integer underflow in Fraction constructor via double clap transform application bsc1273079. - CVE-2026-62291: heap out-of-bounds write in the uncompressed encoder wh...
SUSE-SU-2026:23320-1 Security update for libheif
This update for libheif fixes the following issues: Update to version 1.23.1 jscPED-16355. Security issues fixed: - CVE-2026-62289: integer underflow in Fraction constructor via double clap transform application bsc1273079. - CVE-2026-62291: heap out-of-bounds write in the uncompressed encoder wh...
PT-2026-89112
Name of the Vulnerable Software and Affected Versions libheif versions 1.22.0 through 1.23.1 sharp versions prior to 0.35.4 next.js versions prior to 15.5.24 next.js versions prior to 16.3.3 ImageMagick affected versions not specified Description A heap out-of-bounds write exists in the HEIF and...