Strukturag Libheif vulnerabilities

CVE-2026-32740 [HIGH] CWE-787 CVE-2026-32740: libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.21.2 and prior contain a heap libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.21.2 and prior contain a heap-buffer-overflow (write) vulnerability in the grid tile compositing, allowing an attacker to write 64 bytes of fully attacker-controlled data past the end of a chroma plane heap allocation by crafting a HEIF/AVIF file with a 1×4 grid of odd-height tiles

CVE-2026-47247 [HIGH] CWE-200 CVE-2026-47247: libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, two bugs in lib libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, two bugs in libheif chain to leak process heap memory as visible pixel values in decoded grid images. An attacker who uploads a crafted AVIF/HEIC file to any server-side image processor (WordPress, Sharp/libvips, ImageMagick, etc.) can recover heap data - including li

CVE-2026-47178 [HIGH] CWE-787 CVE-2026-47178: libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.19.0 through 1.21.2, a cra libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.19.0 through 1.21.2, a crafted HEIF file (uncompressed `unci` codec, tiled, component-interleaved, 4:2:0) triggers a heap out-of-bounds write in libheif's uncompressed tile decoder. The write overwrites the C++ vtable pointer of an adjacent `unc_decoder_component_interleave` obj

CVE-2026-41071 [HIGH] CWE-125 CVE-2026-41071: libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, a crafted libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, a crafted HEIF sequence file where the saiz box declares more samples than actually exist in the track's chunk table causes a heap-buffer-overflow (out-of-bounds read) in the SampleAuxInfoReader constructor. The SampleAuxInfoReader constructor iterates over saiz->

CVE-2026-32741 [HIGH] CWE-122 CVE-2026-32741: libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.21.2 and below contain a heap libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.21.2 and below contain a heap buffer overflow in MaskImageCodec::decode_mask_image(). When decoding a HEIF file containing a mask image (mski), the function copies the full iloc extent data into a pixel buffer using memcpy(dst, data.data(), data.size()). The copy length data.size()

CVE-2026-32814 [MEDIUM] CWE-200 CVE-2026-32814: libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, when decod libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, when decoding a HEIF grid image with strict_decoding=false (the default), a corrupted tile silently fails to decode and the library returns heif_error_Ok with no indication of failure, leading to an uninitialized heap memory information leak. The canvas is allo

CVE-2026-32882 [HIGH] CWE-125 CVE-2026-32882: libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.21.2 and prior contain a heap libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.21.2 and prior contain a heap buffer over-read in HeifPixelImage::overlay() in libheif/pixelimage.cc. When compositing an overlay image (iovl) whose child image has a different bit depth for the alpha channel than for the color channels, the function indexes into the alpha plane us

CVE-2025-68431 [HIGH] CWE-125 CVE-2025-68431: libheif is an HEIF and AVIF file format decoder and encoder. Prior to version 1.21.0, a crafted HEIF libheif is an HEIF and AVIF file format decoder and encoder. Prior to version 1.21.0, a crafted HEIF that exercises the overlay image item path triggers a heap buffer over-read in `HeifPixelImage::overlay()`. The function computes a negative row length (likely from an unclipped overlay rectangle or invalid offsets), which then underflows when converte

CVE-2026-48029 [HIGH] CWE-125 CVE-2026-48029: libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.19.0 through 1.21.2 have a he libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.19.0 through 1.21.2 have a heap OOB read in ImageItem_Grid::decode_grid_tile via irot-induced tile-coordinate underflow. Version 1.22.0 fixes the issue.

CVE-2026-49271 [MEDIUM] CWE-125 CVE-2026-49271: libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.1, the uncompresse libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.1, the uncompressed HEIF decoder validates explicit icef compressed-unit offsets using unit_offset + unit_size. Because the addition can wrap, a crafted HEIF file can pass the range check and then construct a vector from iterators outside the compressed item buffer, pr

CVE-2026-32739 [MEDIUM] CWE-835 CVE-2026-32739: libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and below, a crafted libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and below, a crafted 800-byte HEIF sequence file causes an infinite loop in Box_stts::get_sample_duration(), consuming 100% CPU indefinitely with zero progress, leading to DoS. The loop has no iteration limit or timeout and is triggered during file open (parsing) - before

CVE-2026-41069 [MEDIUM] CWE-125 CVE-2026-41069: libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, a malforme libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, a malformed HEIF sequence file can trigger an out-of-bounds read in core sequence parsing logic, causing DoS. A malformed file can have stco.entry_count == 0 (creating no chunks) while still passing validation because saio.entry_count == 0 matches, but with sai

CVE-2026-32738 [MEDIUM] CWE-125 CVE-2026-32738: libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and below, a crafted libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and below, a crafted 792-byte HEIF sequence file with samples_per_chunk=0 in the stsc box causes an unsigned integer underflow in the Chunk constructor (m_last_sample = 0 + 0 - 1 = UINT32_MAX), mapping all samples to an empty chunk and resulting in a denial of service. Whe

CVE-2026-47714 [MEDIUM] CWE-190 CVE-2026-47714: libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, the inline libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, the inline mask parsing code in `libheif/region.cc` contains an integer overflow. Both `width` and `height` are `unsigned int` (32-bit) values parsed from the HEIF file. Their product can exceed `UINT32_MAX`, wrapping to a small value before the division by 8.

CVE-2026-47254 [MEDIUM] CWE-125 CVE-2026-47254: libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, `Track::init_sa libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, `Track::init_sample_timing_table()` in `libheif/sequences/track.cc` stores an out-of-bounds chunk index (`m_chunks.size()`) into `m_presentation_timeline` when the number of chunks defined in the `stco` box is less than the number of samples in `stsz`. A subsequent

CVE-2026-47709 [MEDIUM] CWE-476 CVE-2026-47709: libheif is a HEIF and AVIF file format decoder and encoder. Versions prior to 1.22.0 crashes in the libheif is a HEIF and AVIF file format decoder and encoder. Versions prior to 1.22.0 crashes in the public C API `heif_image_handle_get_image_tiling()` when a malformed uncompressed HEIF image item has an associated `uncC` property but no associated `ispe` property. In debug builds this trips the `ispe && uncC` assertion in `ImageItem_uncompressed::g

CVE-2026-3949 [LOW] CWE-119 CVE-2026-3949: A vulnerability was determined in strukturag libheif up to 1.21.2. This affects the function vvdec_p A vulnerability was determined in strukturag libheif up to 1.21.2. This affects the function vvdec_push_data2 of the file libheif/plugins/decoder_vvdec.cc of the component HEIF File Parser. Executing a manipulation of the argument size can lead to out-of-bounds read. The attack needs to be launched locally. The exploit has been publicly disclosed and may

CVE-2026-3950 [LOW] CWE-119 CVE-2026-3950: A vulnerability was identified in strukturag libheif up to 1.21.2. This impacts the function Track:: A vulnerability was identified in strukturag libheif up to 1.21.2. This impacts the function Track::load of the file libheif/sequences/track.cc of the component stsz/stts. The manipulation leads to out-of-bounds read. The attack needs to be performed locally. The exploit is publicly available and might be used. Applying a patch is the recommended action