Astra Linux – Vulnerability in libheif

libheif is a decoder and encoder for HEIF and AVIF file formats. Prior to version 1.21.0, a crafted HEIF file that used overlay image item paths triggered a heap buffer overflow in HeifPixelImage::overlay. This function calculated a negative row length likely derived from an unclipped overlay...

Advisory ROSA-SA-2026-3256

software: libheif 1.12.0 WASP: ROSA-CHROME unaffected versions = libheif-1.12.0-6 affected versions libheif-1.12.0-6 CVE-ID: CVE-2025-68431 BDU-ID: None CVE-Crit: MEDIUM CVE-DESC.: In libheif HEIF/AVIF decoder/encoder before 1.21.0, when processing a specially formed HEIF with an overlay element ...