| Bug | bookworm | trixie | forky | sid | Description |
|---|
| TEMP-1148137-089975 | vulnerable | fixed | fixed | fixed | GHSA-xrp2-63fq-jm8q: Unbounded iref entry list and unbounded recursion in the reference-cycle check crash the parser |
| TEMP-1148137-126A7B | vulnerable | fixed | fixed | fixed | GHSA-vg7w-rp49-4fc2: The max_items security limit is not enforced for iinf child boxes |
| TEMP-0000000-FDE8B2 | vulnerable | fixed | fixed | fixed | GHSA-vv35-6hxg-95x8: Decoded image can have another bit depth than the image handle reports |
| TEMP-0000000-F2B97A | vulnerable | fixed | fixed | fixed | GHSA-v8qw-hwjv-44hw: AV1/libaom path allows allocation before libheif rejects mismatched coded dimensions |
| TEMP-0000000-DB3DE2 | vulnerable | fixed | fixed | fixed | GHSA-qwpf-5wf7-r996: Heap-use-after-free and double free in ImageItem::encode_to_bitstream_and_boxes (shallow copy of ImageDescription::m_tai_timestamp) |
| TEMP-0000000-D2EEB5 | vulnerable | fixed | fixed | fixed | GHSA-86ch-j429-fpr2: HEVC size limits can be skipped before decoding with the FFmpeg decoder plugin |
| TEMP-0000000-D1A721 | vulnerable | fixed | fixed | fixed | GHSA-x8r2-mggj-j6wr: Heap buffer overflow in unci mixed-interleave decoding with unequal chroma bit depths |
| TEMP-0000000-BBE297 | vulnerable | fixed | fixed | fixed | GHSA-w7mc-p8jc-p853: heap OOB read / info disclosure (Op_YCbCr420_to_RRGGBBaa |
| TEMP-0000000-809756 | vulnerable | fixed | fixed | fixed | GHSA-3gwx-cjv4-jr74: Reachable assertion when decoding a grid image with an alpha plane of more than 16 bits |
| TEMP-0000000-153207 | vulnerable | vulnerable | vulnerable | vulnerable | GHSA-vr5j-9r89-725x: CPU amplification in unci decode path surviving GHSA-24wx-9w62-c96w fix |
| TEMP-0000000-9253BB | vulnerable | fixed | fixed | fixed | GHSA-hqpw-h8p6-22q9: Heap out-of-bounds read in the FFmpeg decoder plugin: input passed to av_parser_parse2() without padding |
| TEMP-0000000-5124DE | vulnerable | fixed | fixed | fixed | GHSA-hvwh-xpj6-ph5x: Error message used after free in heif-enc input loaders |
| TEMP-0000000-956D99 | vulnerable | fixed | fixed | fixed | GHSA-9c75-9g8r-4728: JPEG 2000 pclr zero-column allocation amplification bypasses max_total_memory |
| TEMP-0000000-415AE1 | vulnerable | fixed | fixed | fixed | GHSA-6fqc-p7r8-2g36: CPU amplification: a generically compressed `unci` item is decompressed once per tile |
| TEMP-0000000-301DE5 | vulnerable | fixed | fixed | fixed | GHSA-q7mw-2fmm-5q94: Out-of-bounds read in libsharpyuv through sample values above the image's bit depth |
| TEMP-0000000-78AC20 | vulnerable | fixed | fixed | fixed | GHSA-4jqm-2x34-6f6r: Heap buffer overflow in SVT-AV1 encoder for high-bit-depth alpha channels |
| TEMP-0000000-57F868 | vulnerable | fixed | fixed | fixed | GHSA-8p2c-9wv4-rx4p: NULL pointer dereference in `Track_Visual::decode_next_image_sample()` when a sequence chunk references a non-visual sample entry |
| TEMP-0000000-21F713 | vulnerable | fixed | fixed | fixed | GHSA-7pwf-qh74-p35w: Caller-configured security limits not enforced for MINI-box parsing |
| TEMP-0000000-18A2CE | vulnerable | fixed | fixed | fixed | GHSA-r7gr-2xm2-23wf: Heap out-of-bounds read in libheif alpha compositing via mismatched per-channel bit depths (uncompressed codec) |
| TEMP-0000000-8A4B18 | vulnerable | fixed | fixed | fixed | GHSA-fcmw-5764-7rq8: Decompressed `unci` tile data escapes the memory budget in the `cmpC` `image_tile` branch |
| TEMP-0000000-6C5194 | vulnerable | fixed | fixed | fixed | GHSA-v5rj-g4wv-j5w3: Uncompressed codec returns chroma samples above the declared bit depth in mixed interleave mode |
| TEMP-0000000-4EF776 | vulnerable | fixed | fixed | fixed | GHSA-9rj8-5mp5-26c9: Out-of-bounds read in RGB-YCbCr identity-matrix colour conversion with mismatched per-channel bit depths |
| TEMP-0000000-1B5D39 | vulnerable | fixed | fixed | fixed | GHSA-h4h8-qgvc-m7r2: OpenJPEG decoder: tile and component counts of a JPEG 2000 codestream cause allocations of several gigabytes regardless of the security limits |
| TEMP-0000000-0F03E5 | vulnerable | fixed | fixed | fixed | GHSA-qfj5-c4pq-q998: Out-of-bounds heap read in unc_encoder_rgb_pixel_interleave when an alpha plane is attached to an image whose chroma format carries no alpha |
| CVE-2026-84451 | vulnerable | fixed | fixed | fixed | libheif is a HEIF and AVIF file format decoder and encoder. From 1.19. ... |
| CVE-2026-84450 | vulnerable | fixed | fixed | fixed | libheif is a HEIF and AVIF file format decoder and encoder. From 1.19. ... |
| CVE-2026-84449 | vulnerable | fixed | fixed | fixed | libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1 ... |
| CVE-2026-84448 | vulnerable | fixed | fixed | fixed | libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1 ... |
| CVE-2026-84447 | vulnerable | fixed | fixed | fixed | libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.1 ... |
| CVE-2026-84446 | vulnerable | fixed | fixed | fixed | libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1 ... |
| CVE-2026-84444 | vulnerable | fixed | fixed | fixed | libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1 ... |
| CVE-2026-84384 | vulnerable | fixed | fixed | fixed | libheif is a HEIF and AVIF file format decoder and encoder. From 1.19. ... |
| CVE-2026-62292 | vulnerable | fixed | fixed | fixed | libheif is a HEIF and AVIF file format decoder and encoder. From 1.19. ... |
| CVE-2026-62289 | vulnerable | fixed | fixed | fixed | libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 ... |
| CVE-2026-50142 | vulnerable | fixed | fixed | fixed | libheif is a HEIF and AVIF file format decoder and encoder. From 1.19. ... |
| CVE-2026-49271 | vulnerable | fixed | fixed | fixed | libheif is a HEIF and AVIF file format decoder and encoder. Prior to v ... |
| CVE-2026-48029 | vulnerable | fixed | fixed | fixed | libheif is a HEIF and AVIF file format decoder and encoder. Versions 1 ... |
| CVE-2026-47714 | vulnerable | fixed | fixed | fixed | libheif is a HEIF and AVIF file format decoder and encoder. In version ... |
| CVE-2026-47709 | vulnerable | fixed | fixed | fixed | libheif is a HEIF and AVIF file format decoder and encoder. Versions p ... |
| CVE-2026-47254 | vulnerable | fixed | fixed | fixed | libheif is a HEIF and AVIF file format decoder and encoder. Prior to v ... |
| CVE-2026-47247 | vulnerable | fixed | fixed | fixed | libheif is a HEIF and AVIF file format decoder and encoder. Prior to v ... |
| CVE-2026-47178 | vulnerable | fixed | fixed | fixed | libheif is a HEIF and AVIF file format decoder and encoder. In version ... |
| CVE-2026-41071 | vulnerable | fixed | fixed | fixed | libheif is a HEIF and AVIF file format decoder and encoder. In version ... |
| CVE-2026-41069 | vulnerable | fixed | fixed | fixed | libheif is a HEIF and AVIF file format decoder and encoder. In version ... |
| CVE-2026-32882 | vulnerable | fixed | fixed | fixed | libheif is a HEIF and AVIF file format decoder and encoder. Versions 1 ... |
| CVE-2026-32814 | vulnerable | fixed | fixed | fixed | libheif is a HEIF and AVIF file format decoder and encoder. In version ... |
| CVE-2026-32741 | vulnerable | fixed | fixed | fixed | libheif is a HEIF and AVIF file format decoder and encoder. Versions 1 ... |
| CVE-2026-32740 | vulnerable | fixed | fixed | fixed | libheif is a HEIF and AVIF file format decoder and encoder. Versions 1 ... |
| CVE-2026-32739 | vulnerable | fixed | fixed | fixed | libheif is a HEIF and AVIF file format decoder and encoder. In version ... |
| CVE-2026-32738 | vulnerable | fixed | fixed | fixed | libheif is a HEIF and AVIF file format decoder and encoder. In version ... |
| CVE-2025-68431 | vulnerable (no DSA) | fixed | fixed | fixed | libheif is an HEIF and AVIF file format decoder and encoder. Prior to ... |
| Bug | Description |
|---|
| TEMP-1148137-C949C9 | GHSA-prgh-72vc-3xmc: Lock-order inversion in parallel grid tile decoding deadlocks the decoder permanently |
| TEMP-1148137-B86263 | GHSA-4rv4-953r-p24q: Unreclaimable memory leak and uncaught std::bad_alloc in heif_track_get_next_raw_sequence_sample() |
| TEMP-1148137-B9D557 | GHSA-fqpw-fj22-78w4: Heap out-of-bounds read in encoder plugins for images whose luma and chroma bit depths differ |
| TEMP-1148137-4FB36D | GHSA-rhgw-q5g8-xjh2: WebCodecs decoder plugin reads the coded rectangle out of a buffer sized for the visible rectangle |
| TEMP-0000000-362C9C | GHSA-8fmq-r4pf-7m57: decoder deadlock (DoS) via alpha-aux reference cycle |
| TEMP-0000000-83ADA8 | GHSA-4h82-g446-83fm: Heap-buffer-overflow read in uncompressed (`uncv`) HEIF sequence RGB conversion for odd-height 4:2:0 frames |
| CVE-2026-84383 | libheif is a HEIF and AVIF file format decoder and encoder. From 1.22. ... |
| CVE-2026-62377 | libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 ... |
| CVE-2026-62291 | libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 ... |
| CVE-2026-47251 | libheif is a HEIF and AVIF file format decoder and encoder. The fix fo ... |
| CVE-2026-3950 | A vulnerability was identified in strukturag libheif up to 1.21.2. Thi ... |
| CVE-2025-43967 | libheif before 1.19.6 has a NULL pointer dereference in ImageItem_Grid ... |
| CVE-2025-43966 | libheif before 1.19.6 has a NULL pointer dereference in ImageItem_iden ... |
| CVE-2024-41311 | In Libheif 1.17.6, insufficient checks in ImageOverlay::parse() decodi ... |
| CVE-2023-49464 | libheif v1.17.5 was discovered to contain a segmentation violation via ... |
| CVE-2023-49462 | libheif v1.17.5 was discovered to contain a segmentation violation via ... |
| CVE-2023-49460 | libheif v1.17.5 was discovered to contain a segmentation violation via ... |
| CVE-2023-29659 | A Segmentation fault caused by a floating point exception exists in li ... |
| CVE-2023-0996 | There is a vulnerability in the strided image data parsing code in the ... |
| CVE-2020-23109 | Buffer overflow vulnerability in function convert_colorspace in heif_c ... |
| CVE-2020-19499 | An issue was discovered in heif::Box_iref::get_references in libheif 1 ... |
| CVE-2020-19498 | Floating point exception in function Fraction in libheif 1.4.0, allows ... |
| CVE-2019-11471 | libheif 1.4.0 has a use-after-free in heif::HeifContext::Image::set_al ... |