CVE-2026-32882

libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.21.2 and prior contain a heap buffer over-read in HeifPixelImage::overlay in libheif/pixelimage.cc. When compositing an overlay image iovl whose child image has a different bit depth for the alpha channel than for the color...

CVE-2026-43117

CVE-2026-43117 affects the Linux kernel’s btrfs tracepoints: when overlay is layered on btrfs, dentry->d_sb may reference the overlay superblock, causing a crash during fsid assignment. The root cause is deriving the wrong superblock for the event btrfs_sync_file(); the fix is to use file_inod...