Strukturag Libheif vulnerabilities

CVE-2026-84383 [CRITICAL] CWE-787 CVE-2026-84383: libheif is a HEIF and AVIF file format decoder and encoder. From 1.22.0 until 1.23.2, a crafted HEIF libheif is a HEIF and AVIF file format decoder and encoder. From 1.22.0 until 1.23.2, a crafted HEIF, HEIC, or AVIF item graph using nested iden and auxl references can make HeifPixelImage::transfer_channel_from_image_as() append duplicate Alpha planes with different bit depths to m_storage. HeifPixelImage::scale_nearest_neighbor() in libheif/imag

CVE-2026-32740 [HIGH] CWE-787 CVE-2026-32740: libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.21.2 and prior contain a heap libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.21.2 and prior contain a heap-buffer-overflow (write) vulnerability in the grid tile compositing, allowing an attacker to write 64 bytes of fully attacker-controlled data past the end of a chroma plane heap allocation by crafting a HEIF/AVIF file with a 1×4 grid of odd-height tiles

CVE-2026-62292 [HIGH] CWE-125 CVE-2026-62292: libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.1, a crafted unco libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.1, a crafted uncompressed HEIF image using generic zlib unci full-item compression can crash an application that decodes an advertised tile with heif_image_handle_decode_image_tile(). In libheif/codecs/uncompressed/unc_decoder.cc, unc_decoder::fetch_tile_data() computes

CVE-2026-47247 [HIGH] CWE-200 CVE-2026-47247: libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, two bugs in lib libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, two bugs in libheif chain to leak process heap memory as visible pixel values in decoded grid images. An attacker who uploads a crafted AVIF/HEIC file to any server-side image processor (WordPress, Sharp/libvips, ImageMagick, etc.) can recover heap data - including li

CVE-2026-84444 [HIGH] CWE-787 CVE-2026-84444: libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, when WITH_UNCOMPRESSED_ libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, when WITH_UNCOMPRESSED_CODEC is enabled, heif_context_add_image_tile() accepts an independently constructed tile whose component-plane dimensions do not match the tile geometry established by the prototype image. ImageItem_uncompressed::add_image_tile() passes that tile direc

CVE-2026-84384 [HIGH] CWE-409 CVE-2026-84384: libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.2, crafted HEIF o libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.2, crafted HEIF or AVIF mime metadata and unci image data can cause decompress_brotli() and do_inflate() to grow accumulated output without an effective size limit or MemoryHandle accounting. The brotli path has no output bound, while the zlib path checks only a small t

CVE-2026-47178 [HIGH] CWE-787 CVE-2026-47178: libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.19.0 through 1.21.2, a cra libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.19.0 through 1.21.2, a crafted HEIF file (uncompressed `unci` codec, tiled, component-interleaved, 4:2:0) triggers a heap out-of-bounds write in libheif's uncompressed tile decoder. The write overwrites the C++ vtable pointer of an adjacent `unc_decoder_component_interleave` obj

CVE-2026-50142 [HIGH] CWE-190 CVE-2026-50142: libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.0, a crafted HEIF libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.0, a crafted HEIF sequence accepted by heif_context_read_from_memory() with the msf1 sequence brand can cause unbounded heap allocation. In libheif/sequences/seq_boxes.cc, Box_stsz::parse() applies max_sequence_frames only to variable-size samples, so fixed-size mode ac

CVE-2026-84447 [HIGH] CWE-770 CVE-2026-84447: libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.1 and earlier, crafted grid, iov libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.1 and earlier, crafted grid, iovl, and iden reference graphs can repeatedly decode the same base image because processed_ids is copied per branch and ImageItem::decode_image() has no shared operation budget. This vulnerability is fixed in 1.23.2.

CVE-2026-84446 [HIGH] CWE-835 CVE-2026-84446: libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, crafted HEIF sequence t libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, crafted HEIF sequence timing and edit-list data can make Track::init_sample_timing_table() compute a logical m_num_output_samples value that exceeds the uint32_t counters used by Track_Visual::decode_next_image_sample() and Track::get_next_sample_raw_data(). The resulting com

CVE-2026-41071 [HIGH] CWE-125 CVE-2026-41071: libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, a crafted libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, a crafted HEIF sequence file where the saiz box declares more samples than actually exist in the track's chunk table causes a heap-buffer-overflow (out-of-bounds read) in the SampleAuxInfoReader constructor. The SampleAuxInfoReader constructor iterates over saiz->

CVE-2026-32741 [HIGH] CWE-122 CVE-2026-32741: libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.21.2 and below contain a heap libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.21.2 and below contain a heap buffer overflow in MaskImageCodec::decode_mask_image(). When decoding a HEIF file containing a mask image (mski), the function copies the full iloc extent data into a pixel buffer using memcpy(dst, data.data(), data.size()). The copy length data.size()

CVE-2026-32882 [HIGH] CWE-125 CVE-2026-32882: libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.21.2 and prior contain a heap libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.21.2 and prior contain a heap buffer over-read in HeifPixelImage::overlay() in libheif/pixelimage.cc. When compositing an overlay image (iovl) whose child image has a different bit depth for the alpha channel than for the color channels, the function indexes into the alpha plane us

CVE-2026-32814 [MEDIUM] CWE-200 CVE-2026-32814: libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, when decod libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, when decoding a HEIF grid image with strict_decoding=false (the default), a corrupted tile silently fails to decode and the library returns heif_error_Ok with no indication of failure, leading to an uninitialized heap memory information leak. The canvas is allo

CVE-2026-48029 [HIGH] CWE-125 CVE-2026-48029: libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.19.0 through 1.21.2 have a he libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.19.0 through 1.21.2 have a heap OOB read in ImageItem_Grid::decode_grid_tile via irot-induced tile-coordinate underflow. Version 1.22.0 fixes the issue.

CVE-2025-68431 [HIGH] CWE-125 CVE-2025-68431: libheif is an HEIF and AVIF file format decoder and encoder. Prior to version 1.21.0, a crafted HEIF libheif is an HEIF and AVIF file format decoder and encoder. Prior to version 1.21.0, a crafted HEIF that exercises the overlay image item path triggers a heap buffer over-read in `HeifPixelImage::overlay()`. The function computes a negative row length (likely from an unclipped overlay rectangle or invalid offsets), which then underflows when converte

CVE-2026-49271 [MEDIUM] CWE-125 CVE-2026-49271: libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.1, the uncompresse libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.1, the uncompressed HEIF decoder validates explicit icef compressed-unit offsets using unit_offset + unit_size. Because the addition can wrap, a crafted HEIF file can pass the range check and then construct a vector from iterators outside the compressed item buffer, pr

CVE-2026-32739 [MEDIUM] CWE-835 CVE-2026-32739: libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and below, a crafted libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and below, a crafted 800-byte HEIF sequence file causes an infinite loop in Box_stts::get_sample_duration(), consuming 100% CPU indefinitely with zero progress, leading to DoS. The loop has no iteration limit or timeout and is triggered during file open (parsing) - before

CVE-2026-41069 [MEDIUM] CWE-125 CVE-2026-41069: libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, a malforme libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, a malformed HEIF sequence file can trigger an out-of-bounds read in core sequence parsing logic, causing DoS. A malformed file can have stco.entry_count == 0 (creating no chunks) while still passing validation because saio.entry_count == 0 matches, but with sai

CVE-2026-32738 [MEDIUM] CWE-125 CVE-2026-32738: libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and below, a crafted libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and below, a crafted 792-byte HEIF sequence file with samples_per_chunk=0 in the stsc box causes an unsigned integer underflow in the Chunk constructor (m_last_sample = 0 + 0 - 1 = UINT32_MAX), mapping all samples to an empty chunk and resulting in a denial of service. Whe