CVE-2025-43967

CVE-2025-43967 involves a NULL pointer dereference in libheif

CVE-2019-11471

CVE-2019-11471 affects libheif 1.4.0 with a use-after-free in HeifContext::Image::set_alpha_channel due to mishandling references to non-existing alpha images. Multiple advisories (Mageia MGASA-2019-0290/2024-0243, OSV USN 6847-1, Ubuntu USN 6847-1) indicate this issue can crash the program and c...

CVE-2024-41311

Summary: CVE-2024-41311 affects Libheif 1.17.6 and is tied to an insufficient checks issue in ImageOverlay::parse() when decoding a HEIF with forged overlay offsets, leading to an out-of-bounds read and write. Publicly documented references indicate multiple OSS advisories and vendor responses. A...

CVE-2026-41071

CVE-2026-41071 affects libheif up to version 1.21.2. A crafted HEIF sequence file where the saiz box declares more samples than actually exist can trigger a heap‑buffer‑overflow (out‑of‑bounds read) in the SampleAuxInfoReader constructor when parsing via heif_context_read_from_file. The reader it...

CVE-2023-29659

CVE-2023-29659 affects libheif 1.15.1 where a crafted HEIF image can trigger a segmentation fault via the heif::Fraction::round() path in box.cc, leading to denial of service. Connected advisories across major distros confirm this as a vulnerability in the library and reference various patches: D...

CVE-2025-43966

CVE-2025-43966 affects libheif prior to 1.19.6, with a NULL pointer dereference in ImageItem_iden (iden.cc). Root cause: dereference of a null item reference leading to potential crash. Impact: availability may be reduced (per CVSS in public entry). Remediation: upgrade libheif to version 1.19.6 ...

CVE-2026-32740

libheif (HEIF/AVIF decoder/encoder) versions

CVE-2026-41069

Summary: CVE-2026-41069 affects libheif up to v1.21.2, where a malformed HEIF sequence can trigger an out-of-bounds read in core sequence parsing, leading to DoS. The issue occurs when stco.entry_count == 0 but saiz.sample_count > 0, causing the SampleAuxInfoReader loop to dereference an empty...

CVE-2026-47178

CVE-2026-47178 affects libheif up to v1.21.2, where a crafted uncompressed HEIF image (unci codec, tiled, component-interleaved, 4:2:0) can trigger a heap out-of-bounds write in the uncompressed tile decoder. The write overwrites a nearby C++ vtable pointer, causing the next virtual call to dispa...

CVE-2023-0996

CVE-2023-0996 affects libheif (strided image data parsing in the Emscripten wrapper), enabling a crafted image to trigger a buffer overflow in linear memory during memcpy. Connected advisories confirm libheif as the affected component across multiple distros (Debian DLA-3945; Mageia update; Ubunt...

CVE-2023-49462

CVE-2023-49462 affects libheif 1.17.5, with a segmentation fault in /libheif/exif.cc. The issue can cause instability and, per related advisories, may lead to denial of service; some sources imply potential for broader impact. Affected ecosystems cite multiple vendors (Debian, Mageia, Ubuntu, etc...

CVE-2025-29482

CVE-2025-29482 is a Buffer Overflow vulnerability in libheif 1.19.7 that allows a local attacker to execute arbitrary code via SAO (Sample Adaptive Offset) processing in libde265. The issue is triggered by a flaw in the SAO processing path, leading to an out-of-bounds/write condition. The CVSS ve...

CVE-2025-68431

CVE-2025-68431 affects libheif prior to version 1.21.0, where a crafted HEIF exploiting the overlay image item path triggers a heap buffer over-read in HeifPixelImage::overlay() . The root cause is a negative row length (likely from an unclipped overlay rectangle or invalid offsets) that underflo...

CVE-2020-23109

CVE-2020-23109 : A buffer overflow in libheif 1.6.2 (function convert_colorspace in heif_colorconversion.cc) can be triggered by a crafted HEIF file, enabling denial of service and potential information disclosure. Connected advisories confirm affected packages and that a fix is available in libh...

CVE-2023-49460

CVE-2023-49460 affects libheif version 1.17.5 where the segmentation violation occurs in UncompressedImageCodec::decode_uncompressed_image. Connected advisories confirm this leads to crashes and potential denial of service under exploitation, with CVSS v3.1 base score 8.8 (NETWORK, HIGH) and no p...

CVE-2023-49463

CVE-2023-49463 affects libheif v1.17.5, with a segmentation fault in find_exif_tag (libheif/exif.cc). Public records (NVD) rate the impact as high (CVSS v3.1: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H; base score 8.8). Several connected advisories reference the same issue alongside other libheif CVEs (...

CVE-2024-25269

CVE-2024-25269 : Upstream reports show that libheif

CVE-2020-19499

CVE-2020-19499 affects libheif 1.4.0, specifically the heif::Box_iref::get_references path. The issue enables Denial of Service (and possibly other unspecified impacts) via an invalid memory read. Multiple connected sources (SUSE, Red Hat, CNVD, OSV, NVD cross-references) confirm the presence of ...

CVE-2020-19498

The provided connected records confirm a vulnerability in libheif 1.4.0 where a floating-point exception in the Fraction function can lead to a Denial of Service (and possibly other unspecified impacts). Evidence comes from multiple sources (CNVD-2022-06517, SUSE CVE page, Debian osv, OSV entries...

CVE-2023-49464

CVE-2023-49464 affects libheif, specifically libheif v1.17.5, with a segmentation fault arising from UncompressedImageCodec::get_luma_bits_per_pixel_from_configuration_unci. The CVE is listed across multiple advisories (Mageia, OpenVAS/USN feeds, Ubuntu USN) as part of a set of libheif issues, al...

CVE-2026-49271

CVE-2026-49271 affects libheif prior to 1.22.1. The uncompressed HEIF decoder validates icef compressed-unit offsets with unit_offset + unit_size, which can wrap and allow constructing iterators outside the compressed item buffer, causing an out-of-bounds heap read and crash. This vulnerability i...

CVE-2026-47709

libheif (HEIF/AVIF decoder/encoder) has a null pointer dereference in heif_image_handle_get_image_tiling for malformed uncompressed image items with uncC but no ispe. In debug builds this triggers an ispe && uncC assertion; in release/ASan builds it can cause a null read at address 0xa8. Affected...

CVE-2026-32738

libheif (versions

CVE-2026-47247

Libheif vulnerability CVE-2026-47247: Prior to 1.22.0, two bugs in the libheif decoding path can leak heap memory as visible pixel data in grid images. An attacker uploading a crafted AVIF/HEIC to server-side image processors (e.g., WordPress, Sharp/libvips, ImageMagick) can recover heap data fro...

CVE-2026-32739

libheif (HEIF/AVIF decoder) is affected through versions 1.21.2 and earlier, where a crafted 800-byte HEIF sequence file can trigger an infinite loop in Box_stts::get_sample_duration() during parsing, causing 100% CPU DoS with no progress and no crashログ. The issue is triggered on file open and is...

CVE-2026-47714

The issue is a concrete, exploitable flaw in libheif up to version 1.21.2 (patched in 1.22.0) where inline mask size calculation in libheif/region.cc can overflow while parsing width and height as 32-bit unsigned ints. Their product can exceed UINT32_MAX, causing an undersized allocation and out-...

CVE-2026-47251

CVE-2026-47251 affects libheif. The description reports that the fix for CVE-2026-3949 introduced an integer overflow check that can be bypassed, allowing a crafted HEIF file with a VVC track to trigger the same out-of-bounds heap read as CVE-2026-3949. This is described as a separate, currently-...

CVE-2026-47254

CVE-2026-47254 affects libheif before 1.22.0. The issue arises when Track::init_sample_timing_table() stores an out-of-bounds chunk index into m_presentation_timeline if the stco-defined chunks are fewer than samples in stsz. A subsequent call to heif_track_get_next_raw_sequence_sample() reads m_...

CVE-2026-48029

CVE-2026-48029 affects libheif: heap OOB read in ImageItem_Grid::decode_grid_tile due to irot-induced tile-coordinate underflow. Affected versions are 1.19.0–1.21.2; fixed in 1.22.0. Several connected advisories (NVD, Debian, Ubuntu, Amazon Linux, OSV, etc.) cite this along with related issues. R...