| Bug | bookworm | trixie | forky | sid | Description |
|---|
| TEMP-0000000-905912 | vulnerable | vulnerable | fixed | fixed | Heap buffer overflow in unci mixed-interleave decoding with unequal chroma bit depths |
| TEMP-0000000-324AE3 | vulnerable | vulnerable | fixed | fixed | heap OOB read / info disclosure (Op_YCbCr420_to_RRGGBBaa |
| TEMP-0000000-1F4FF2 | vulnerable | vulnerable | fixed | fixed | Heap buffer overflow in SVT-AV1 encoder for high-bit-depth alpha channels |
| TEMP-0000000-1ED20C | vulnerable | vulnerable | fixed | fixed | Out-of-bounds read in RGB-YCbCr identity-matrix colour conversion with mismatched per-channel bit depths |
| CVE-2026-84451 | vulnerable | vulnerable | fixed | fixed | Incomplete fix for GHSA-73p7-m7gg-w2jv leaves libheif 1.23.1 vulnerable to an out-of-bounds read |
| CVE-2026-84450 | vulnerable | vulnerable | fixed | fixed | `clap` + oversized `ispe` aborts on an assert in `Fraction::Fraction` (incomplete fix for GHSA-jc8f-p23p-5hjg) |
| CVE-2026-62292 | vulnerable | fixed | fixed | fixed | libheif is a HEIF and AVIF file format decoder and encoder. From 1.19. ... |
| CVE-2026-62289 | vulnerable | fixed | fixed | fixed | libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 ... |
| CVE-2026-50142 | vulnerable | fixed | fixed | fixed | libheif is a HEIF and AVIF file format decoder and encoder. From 1.19. ... |
| CVE-2026-49271 | vulnerable | fixed | fixed | fixed | libheif is a HEIF and AVIF file format decoder and encoder. Prior to v ... |
| CVE-2026-48029 | vulnerable | fixed | fixed | fixed | libheif is a HEIF and AVIF file format decoder and encoder. Versions 1 ... |
| CVE-2026-47714 | vulnerable | fixed | fixed | fixed | libheif is a HEIF and AVIF file format decoder and encoder. In version ... |
| CVE-2026-47709 | vulnerable | fixed | fixed | fixed | libheif is a HEIF and AVIF file format decoder and encoder. Versions p ... |
| CVE-2026-47254 | vulnerable | fixed | fixed | fixed | libheif is a HEIF and AVIF file format decoder and encoder. Prior to v ... |
| CVE-2026-47247 | vulnerable | fixed | fixed | fixed | libheif is a HEIF and AVIF file format decoder and encoder. Prior to v ... |
| CVE-2026-47178 | vulnerable | fixed | fixed | fixed | libheif is a HEIF and AVIF file format decoder and encoder. In version ... |
| CVE-2026-41071 | vulnerable | fixed | fixed | fixed | libheif is a HEIF and AVIF file format decoder and encoder. In version ... |
| CVE-2026-41069 | vulnerable | fixed | fixed | fixed | libheif is a HEIF and AVIF file format decoder and encoder. In version ... |
| CVE-2026-32882 | vulnerable | fixed | fixed | fixed | libheif is a HEIF and AVIF file format decoder and encoder. Versions 1 ... |
| CVE-2026-32814 | vulnerable | fixed | fixed | fixed | libheif is a HEIF and AVIF file format decoder and encoder. In version ... |
| CVE-2026-32741 | vulnerable | fixed | fixed | fixed | libheif is a HEIF and AVIF file format decoder and encoder. Versions 1 ... |
| CVE-2026-32740 | vulnerable | fixed | fixed | fixed | libheif is a HEIF and AVIF file format decoder and encoder. Versions 1 ... |
| CVE-2026-32739 | vulnerable | fixed | fixed | fixed | libheif is a HEIF and AVIF file format decoder and encoder. In version ... |
| CVE-2026-32738 | vulnerable | fixed | fixed | fixed | libheif is a HEIF and AVIF file format decoder and encoder. In version ... |
| CVE-2025-68431 | vulnerable (no DSA) | fixed | fixed | fixed | libheif is an HEIF and AVIF file format decoder and encoder. Prior to ... |
| Bug | Description |
|---|
| TEMP-0000000-D22263 | Heap-buffer-overflow read in uncompressed (`uncv`) HEIF sequence RGB conversion for odd-height 4:2:0 frames |
| TEMP-0000000-18F9D9 | decoder deadlock (DoS) via alpha-aux reference cycle |
| CVE-2026-84383 | GHSA-g89c-p67h-r497: Heap buffer overflow in `scale_nearest_neighbor()` via duplicate Alpha planes from nested `iden`/`auxl` items |
| CVE-2026-62377 | libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 ... |
| CVE-2026-62291 | libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 ... |
| CVE-2026-47251 | libheif is a HEIF and AVIF file format decoder and encoder. The fix fo ... |
| CVE-2026-3950 | A vulnerability was identified in strukturag libheif up to 1.21.2. Thi ... |
| CVE-2025-43967 | libheif before 1.19.6 has a NULL pointer dereference in ImageItem_Grid ... |
| CVE-2025-43966 | libheif before 1.19.6 has a NULL pointer dereference in ImageItem_iden ... |
| CVE-2024-41311 | In Libheif 1.17.6, insufficient checks in ImageOverlay::parse() decodi ... |
| CVE-2023-49464 | libheif v1.17.5 was discovered to contain a segmentation violation via ... |
| CVE-2023-49462 | libheif v1.17.5 was discovered to contain a segmentation violation via ... |
| CVE-2023-49460 | libheif v1.17.5 was discovered to contain a segmentation violation via ... |
| CVE-2023-29659 | A Segmentation fault caused by a floating point exception exists in li ... |
| CVE-2023-0996 | There is a vulnerability in the strided image data parsing code in the ... |
| CVE-2020-23109 | Buffer overflow vulnerability in function convert_colorspace in heif_c ... |
| CVE-2020-19499 | An issue was discovered in heif::Box_iref::get_references in libheif 1 ... |
| CVE-2020-19498 | Floating point exception in function Fraction in libheif 1.4.0, allows ... |
| CVE-2019-11471 | libheif 1.4.0 has a use-after-free in heif::HeifContext::Image::set_al ... |