Struktur Libheif vulnerabilities

CVE-2026-32740 [HIGH] CWE-787 CVE-2026-32740: libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.21.2 and prior contain a heap libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.21.2 and prior contain a heap-buffer-overflow (write) vulnerability in the grid tile compositing, allowing an attacker to write 64 bytes of fully attacker-controlled data past the end of a chroma plane heap allocation by crafting a HEIF/AVIF file with a 1×4 grid of odd-height tiles

CVE-2026-47247 [HIGH] CWE-200 CVE-2026-47247: libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, two bugs in lib libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, two bugs in libheif chain to leak process heap memory as visible pixel values in decoded grid images. An attacker who uploads a crafted AVIF/HEIC file to any server-side image processor (WordPress, Sharp/libvips, ImageMagick, etc.) can recover heap data - including li

CVE-2026-47178 [HIGH] CWE-787 CVE-2026-47178: libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.19.0 through 1.21.2, a cra libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.19.0 through 1.21.2, a crafted HEIF file (uncompressed `unci` codec, tiled, component-interleaved, 4:2:0) triggers a heap out-of-bounds write in libheif's uncompressed tile decoder. The write overwrites the C++ vtable pointer of an adjacent `unc_decoder_component_interleave` obj

CVE-2026-41071 [HIGH] CWE-125 CVE-2026-41071: libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, a crafted libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, a crafted HEIF sequence file where the saiz box declares more samples than actually exist in the track's chunk table causes a heap-buffer-overflow (out-of-bounds read) in the SampleAuxInfoReader constructor. The SampleAuxInfoReader constructor iterates over saiz->

CVE-2023-49462 [HIGH] CVE-2023-49462: libheif v1.17.5 was discovered to contain a segmentation violation via the component /libheif/exif.c libheif v1.17.5 was discovered to contain a segmentation violation via the component /libheif/exif.cc.

CVE-2023-49464 [HIGH] CVE-2023-49464: libheif v1.17.5 was discovered to contain a segmentation violation via the function UncompressedImag libheif v1.17.5 was discovered to contain a segmentation violation via the function UncompressedImageCodec::get_luma_bits_per_pixel_from_configuration_unci.

CVE-2023-49460 [HIGH] CVE-2023-49460: libheif v1.17.5 was discovered to contain a segmentation violation via the function UncompressedImag libheif v1.17.5 was discovered to contain a segmentation violation via the function UncompressedImageCodec::decode_uncompressed_image.

CVE-2024-41311 [HIGH] CWE-125 CVE-2024-41311: In Libheif 1.17.6, insufficient checks in ImageOverlay::parse() decoding a heif file containing an o In Libheif 1.17.6, insufficient checks in ImageOverlay::parse() decoding a heif file containing an overlay image with forged offsets can lead to an out-of-bounds read and write.

CVE-2019-11471 [HIGH] CWE-416 CVE-2019-11471: libheif 1.4.0 has a use-after-free in heif::HeifContext::Image::set_alpha_channel in heif_context.h libheif 1.4.0 has a use-after-free in heif::HeifContext::Image::set_alpha_channel in heif_context.h because heif_context.cc mishandles references to non-existing alpha images.

CVE-2023-49463 [HIGH] CVE-2023-49463: libheif v1.17.5 was discovered to contain a segmentation violation via the function find_exif_tag at libheif v1.17.5 was discovered to contain a segmentation violation via the function find_exif_tag at /libheif/exif.cc.

CVE-2023-0996 [HIGH] CWE-120 CVE-2023-0996: There is a vulnerability in the strided image data parsing code in the emscripten wrapper for libhe There is a vulnerability in the strided image data parsing code in the emscripten wrapper for libheif. An attacker could exploit this through a crafted image file to cause a buffer overflow in linear memory during a memcpy call.

CVE-2025-43967 [HIGH] CWE-476 CVE-2025-43967: libheif before 1.19.6 has a NULL pointer dereference in ImageItem_Grid::get_decoder in image-items/g libheif before 1.19.6 has a NULL pointer dereference in ImageItem_Grid::get_decoder in image-items/grid.cc because a grid image can reference a nonexistent image item.

CVE-2025-43966 [HIGH] CWE-476 CVE-2025-43966: libheif before 1.19.6 has a NULL pointer dereference in ImageItem_iden in image-items/iden.cc. libheif before 1.19.6 has a NULL pointer dereference in ImageItem_iden in image-items/iden.cc.

CVE-2020-19498 [HIGH] CVE-2020-19498: Floating point exception in function Fraction in libheif 1.4.0, allows attackers to cause a Denial o Floating point exception in function Fraction in libheif 1.4.0, allows attackers to cause a Denial of Service or possibly other unspecified impacts.

CVE-2024-25269 [HIGH] CWE-400 CVE-2024-25269: libheif <= 1.17.6 contains a memory leak in the function JpegEncoder::Encode. This flaw allows an at libheif <= 1.17.6 contains a memory leak in the function JpegEncoder::Encode. This flaw allows an attacker to cause a denial of service attack.

CVE-2025-68431 [HIGH] CWE-125 CVE-2025-68431: libheif is an HEIF and AVIF file format decoder and encoder. Prior to version 1.21.0, a crafted HEIF libheif is an HEIF and AVIF file format decoder and encoder. Prior to version 1.21.0, a crafted HEIF that exercises the overlay image item path triggers a heap buffer over-read in `HeifPixelImage::overlay()`. The function computes a negative row length (likely from an unclipped overlay rectangle or invalid offsets), which then underflows when converte

CVE-2020-19499 [HIGH] CWE-125 CVE-2020-19499: An issue was discovered in heif::Box_iref::get_references in libheif 1.4.0, allows attackers to caus An issue was discovered in heif::Box_iref::get_references in libheif 1.4.0, allows attackers to cause a Denial of Service or possibly other unspecified impact due to an invalid memory read.

CVE-2020-23109 [HIGH] CWE-120 CVE-2020-23109: Buffer overflow vulnerability in function convert_colorspace in heif_colorconversion.cc in libheif v Buffer overflow vulnerability in function convert_colorspace in heif_colorconversion.cc in libheif v1.6.2, allows attackers to cause a denial of service and disclose sensitive information, via a crafted HEIF file.

CVE-2026-49271 [MEDIUM] CWE-125 CVE-2026-49271: libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.1, the uncompresse libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.1, the uncompressed HEIF decoder validates explicit icef compressed-unit offsets using unit_offset + unit_size. Because the addition can wrap, a crafted HEIF file can pass the range check and then construct a vector from iterators outside the compressed item buffer, pr

CVE-2026-32739 [MEDIUM] CWE-835 CVE-2026-32739: libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and below, a crafted libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and below, a crafted 800-byte HEIF sequence file causes an infinite loop in Box_stts::get_sample_duration(), consuming 100% CPU indefinitely with zero progress, leading to DoS. The loop has no iteration limit or timeout and is triggered during file open (parsing) - before