Struktur Libheif vulnerabilities

CVE-2026-41069 [MEDIUM] CWE-125 CVE-2026-41069: libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, a malforme libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, a malformed HEIF sequence file can trigger an out-of-bounds read in core sequence parsing logic, causing DoS. A malformed file can have stco.entry_count == 0 (creating no chunks) while still passing validation because saio.entry_count == 0 matches, but with sai

CVE-2026-32738 [MEDIUM] CWE-125 CVE-2026-32738: libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and below, a crafted libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and below, a crafted 792-byte HEIF sequence file with samples_per_chunk=0 in the stsc box causes an unsigned integer underflow in the Chunk constructor (m_last_sample = 0 + 0 - 1 = UINT32_MAX), mapping all samples to an empty chunk and resulting in a denial of service. Whe

CVE-2023-29659 [MEDIUM] CWE-369 CVE-2023-29659: A Segmentation fault caused by a floating point exception exists in libheif 1.15.1 using crafted hei A Segmentation fault caused by a floating point exception exists in libheif 1.15.1 using crafted heif images via the heif::Fraction::round() function in box.cc, which causes a denial of service.

CVE-2026-47714 [MEDIUM] CWE-190 CVE-2026-47714: libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, the inline libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, the inline mask parsing code in `libheif/region.cc` contains an integer overflow. Both `width` and `height` are `unsigned int` (32-bit) values parsed from the HEIF file. Their product can exceed `UINT32_MAX`, wrapping to a small value before the division by 8.

CVE-2026-47254 [MEDIUM] CWE-125 CVE-2026-47254: libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, `Track::init_sa libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, `Track::init_sample_timing_table()` in `libheif/sequences/track.cc` stores an out-of-bounds chunk index (`m_chunks.size()`) into `m_presentation_timeline` when the number of chunks defined in the `stco` box is less than the number of samples in `stsz`. A subsequent

CVE-2026-47251 [MEDIUM] CVE-2026-47251: libheif is a HEIF and AVIF file format decoder and encoder. The fix for CVE-2026-3949 (commit `b97c8 libheif is a HEIF and AVIF file format decoder and encoder. The fix for CVE-2026-3949 (commit `b97c8b5`, PR #1712) introduced an integer overflow in the very security check it added. The check itself can be bypassed, allowing a crafted HEIF file with a VVC track to trigger the same out-of-bounds heap read that CVE-2026-3949 was meant to prevent. This is a s

CVE-2025-29482 [MEDIUM] CWE-120 CVE-2025-29482: Buffer Overflow vulnerability in libheif 1.19.7 allows a local attacker to execute arbitrary code vi Buffer Overflow vulnerability in libheif 1.19.7 allows a local attacker to execute arbitrary code via the SAO (Sample Adaptive Offset) processing of libde265.

CVE-2026-47709 [MEDIUM] CWE-476 CVE-2026-47709: libheif is a HEIF and AVIF file format decoder and encoder. Versions prior to 1.22.0 crashes in the libheif is a HEIF and AVIF file format decoder and encoder. Versions prior to 1.22.0 crashes in the public C API `heif_image_handle_get_image_tiling()` when a malformed uncompressed HEIF image item has an associated `uncC` property but no associated `ispe` property. In debug builds this trips the `ispe && uncC` assertion in `ImageItem_uncompressed::g