PT-2026-105630

These are all security issues fixed in the gdk-pixbuf-loader-libheif-1.23.5-2.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11921-1 gdk-pixbuf-loader-libheif-1.23.5-2.1 on GA media

These are all security issues fixed in the gdk-pixbuf-loader-libheif-1.23.5-2.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11859-1 gdk-pixbuf-loader-libheif-1.23.5-1.1 on GA media

These are all security issues fixed in the gdk-pixbuf-loader-libheif-1.23.5-1.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-89116

Name of the Vulnerable Software and Affected Versions libheif versions prior to 1.23.2 Description Crafted grid, iovl, and iden reference graphs can cause the same base image to be decoded repeatedly. This occurs because processed ids is copied per branch and the decode image function in ImageIte...

PT-2026-89114

Name of the Vulnerable Software and Affected Versions libheif versions prior to 1.23.2 Description When WITH UNCOMPRESSED CODEC is enabled, the heif context add image tile function accepts a tile with component-plane dimensions that differ from the prototype image geometry. The ImageItem...

PT-2026-89117

Name of the Vulnerable Software and Affected Versions libheif versions prior to 1.23.2 Description The heif region item add region inline mask data function in libheif/api/libheif/heif regions.cc accepts the mask data len parameter without verifying if it matches the byte count required by the...

PT-2026-89115

Name of the Vulnerable Software and Affected Versions libheif versions prior to 1.23.2 Description Crafted HEIF sequence timing and edit-list data can cause the init sample timing table function to compute a logical m num output samples value that exceeds the uint32 t counters used by decode next...

PT-2026-89113

Name of the Vulnerable Software and Affected Versions libheif versions 1.19.0 through 1.23.1 Description Crafted HEIF or AVIF mime metadata and unci image data can cause the decompress brotli and do inflate functions to grow accumulated output without an effective size limit or MemoryHandle...

PT-2026-89118

Name of the Vulnerable Software and Affected Versions libheif versions 1.19.0 through 1.23.2 Description A crafted image item containing a clap property and an ispe width or height greater than INT32 MAX + 1 can reach crop calculations through the heif image handle get image tiling function. The...

PT-2026-89119

Name of the Vulnerable Software and Affected Versions libheif versions 1.19.0 through 1.23.2 Description An integer overflow occurs in the unc decoder::get compressed image data uncompressed function within the no-icef full-item branch. This happens when a crafted uncompressed tile grid provides ...

PT-2026-89112

Name of the Vulnerable Software and Affected Versions libheif versions 1.22.0 through 1.23.1 sharp versions prior to 0.35.4 next.js versions prior to 15.5.24 next.js versions prior to 16.3.3 ImageMagick affected versions not specified Description A heap out-of-bounds write exists in the HEIF and...

gdk-pixbuf-loader-libheif-1.23.1-1.1 on GA media (moderate)

gdk-pixbuf-loader-libheif-1.23.1-1.1 on GA media Announcement ID: openSUSE-SU-2026:11416-1 Rating: moderate Cross-References: CVE-2026-62289 CVE-2026-62291 CVE-2026-62292 CVE-2026-62377 Affected Products: openSUSE Tumbleweed An update that solves 4 vulnerabilities can now be installed. Descriptio...

PT-2026-67254

Name of the Vulnerable Software and Affected Versions libheif versions prior to 1.23.1 Description A crafted HEIF sequence processed by the heif context read from memory function can result in a context with no registered sequence tracks. This leads to a crash when the heif context get trackctx, ...

PT-2026-67253

Name of the Vulnerable Software and Affected Versions libheif versions 1.19.0 through 1.23.0 Description A flaw exists in the way uncompressed HEIF images using generic zlib unci full-item compression are handled. When an application decodes an advertised tile using the heif image handle decode...

PT-2026-67252

Name of the Vulnerable Software and Affected Versions libheif versions prior to 1.23.1 Description A flaw exists in the HEIF and AVIF file format decoder and encoder where a specially crafted file containing a clean aperture box can cause an image dimension to be reduced to zero. This occurs when...

OPENSUSE-SU-2026:11416-1 gdk-pixbuf-loader-libheif-1.23.1-1.1 on GA media

These are all security issues fixed in the gdk-pixbuf-loader-libheif-1.23.1-1.1 package on the GA media of openSUSE Tumbleweed...

Amazon Linux 2023 : heif-pixbuf-loader, libheif, libheif-devel (ALAS2023-2026-1919)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1919 advisory. A critical heap-based buffer overflow vulnerability exists in libheif v1.21.2 and likely earlier versions within the handling of uncompressed HEIF images ISO/IEC 23001-17, unci item type. When...

Amazon Linux 2023 : jxl-pixbuf-loader, libjxl, libjxl-devel (ALAS2023-2026-1828)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1828 advisory. Heap buffer overflow vulnerability in libjxl 0.12.0 via crafted PBM images to the jxl::extras::DecodeImagePNM function in file lib/extras/dec/pnm.cc. CVE-2025-70103 Tenable has extracted the preceding...

gdk-pixbuf-loader-libheif-1.23.0-2.1 on GA media (moderate)

gdk-pixbuf-loader-libheif-1.23.0-2.1 on GA media Announcement ID: openSUSE-SU-2026:10983-1 Rating: moderate Cross-References: CVE-2026-49271 CVE-2026-50142 CVSS scores: CVE-2026-49271 SUSE : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2026-49271 SUSE : 6.7...

PT-2026-48604

Name of the Vulnerable Software and Affected Versions libheif versions prior to 1.22.1 Description The uncompressed HEIF decoder validates explicit icef compressed-unit offsets using unit offset + unit size. An integer wrap during this addition allows a crafted HEIF file to bypass range checks an...