Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
49 results
Oct 20, 2026Sharp before 0.35.4 bundles a vulnerable libheif dependency that allows attackers to achieve possible remote code execution on glibc-based Linux by supplying crCVE-2026-114112 · Other software · lovell · reported by VulnCheckHigh 8.9
Sharp before 0.35.4 bundles a vulnerable libheif dependency that allows attackers to achieve possible remote code execution on glibc-based Linux by supplying crafted images. Attackers can submit malicious AVIF/HEIF input to applications processing untrusted images with sharp, triggering libheif decoding flaws to execute code.
- Product
- sharp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 18, 2026libheif is a HEIF and AVIF file format decoder and encoder.CVE-2026-84451 · Other software · strukturag · reported by GitHubMedium 6.5
libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.3, the no-icef full-item branch of unc_decoder::get_compressed_image_data_uncompressed() in libheif/codecs/uncompressed/unc_decoder.cc retains an addition-based range check that can wrap when a crafted uncompressed tile grid produces a large range_start_offset and range_size. The overflow makes the bounds comparison pass and allows heif_image_handle_decode_image_tile() to call memcpy() with an invalid source pointer and a very large length when decoding a valid high-index advertised tile. This incomplete remediation of CVE-2026-62292 can reliably crash tile-processing applications, while whole-image decoding is not claimed to reach the demonstrated path. This issue is fixed in version 1.23.3.
- Product
- libheif
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026libheif is a HEIF and AVIF file format decoder and encoder.CVE-2026-84450 · Other software · strukturag · reported by GitHubMedium 4.3
libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.3, a crafted image item containing a clap property and an ispe width or height greater than INT32_MAX + 1 can reach crop calculations through heif_image_handle_get_image_tiling(). Box_clap::left_rounded() or Box_clap::top_rounded() passes the image dimension minus one to Fraction::Fraction(), whose uint32_t constructor uses an assertion as input validation, causing assert-enabled builds to abort. Release builds can instead compute invalid crop geometry, and the tiling API returns dimensions that the normal decode security limits reject. This issue is fixed in version 1.23.3.
- Product
- libheif
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026libheif is a HEIF and AVIF file format decoder and encoder.CVE-2026-84449 · Other software · strukturag · reported by GitHubLow 3.7
libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.19.6, Op_RGB24_32_to_YCbCr::convert_colorspace() stores image-plane strides in an integer width that can overflow for extremely large RGB images created through heif_image_create() and heif_image_add_plane(). The resulting wrapped stride causes the conversion loop in libheif/color-conversion/rgb2yuv.cc to compute an invalid input pointer and read beyond the allocated interleaved plane while heif_context_encode_image() performs RGB-to-YCbCr conversion. This can crash the encoding process. This issue is fixed in version 1.19.6.
- Product
- libheif
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026libheif is a HEIF and AVIF file format decoder and encoder.CVE-2026-84448 · Other software · strukturag · reported by GitHubMedium 4
libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, the public heif_region_item_add_region_inline_mask_data() function in libheif/api/libheif/heif_regions.cc accepts mask_data_len without verifying that it equals the byte count required by width and height. A later heif_region_get_mask_image() call derives the read length from the region geometry, so an undersized stored buffer causes heif_region_get_inline_mask_image() to read beyond the heap allocation and copy adjacent bytes into the returned monochrome mask image. This can disclose heap data or crash an application that constructs region metadata through the writer API, while the file-parsing path is not affected because it validates the canonical mask size. This issue is fixed in version 1.23.2.
- Product
- libheif
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026libheif is a HEIF and AVIF file format decoder and encoder.CVE-2026-84447 · Other software · strukturag · reported by GitHubHigh 7.5
libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.1 and earlier, crafted grid, iovl, and iden reference graphs can repeatedly decode the same base image because processed_ids is copied per branch and ImageItem::decode_image() has no shared operation budget. This vulnerability is fixed in 1.23.2.
- Product
- libheif
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026libheif is a HEIF and AVIF file format decoder and encoder.CVE-2026-84446 · Other software · strukturag · reported by GitHubHigh 7.5
libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, crafted HEIF sequence timing and edit-list data can make Track::init_sample_timing_table() compute a logical m_num_output_samples value that exceeds the uint32_t counters used by Track_Visual::decode_next_image_sample() and Track::get_next_sample_raw_data(). The resulting comparison can never reach the oversized output count, causing non-terminating decode or raw-sample loops and bypassing max_sequence_frames. The same sequence path repeatedly calls Box_stts::get_sample_duration() and allocates Chunk::m_sample_ranges and Track::m_presentation_timeline outside MemoryHandle accounting, allowing severe CPU and memory exhaustion from a small file. This issue is fixed in version 1.23.2.
- Product
- libheif
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026libheif is a HEIF and AVIF file format decoder and encoder.CVE-2026-84444 · Other software · strukturag · reported by GitHubHigh 7.4
libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, when WITH_UNCOMPRESSED_CODEC is enabled, heif_context_add_image_tile() accepts an independently constructed tile whose component-plane dimensions do not match the tile geometry established by the prototype image. ImageItem_uncompressed::add_image_tile() passes that tile directly to unc_encoder::encode_tile(), which lacked the check_component_sizes() gate and sizes its output from the configured tile geometry while copying the tile's actual component-plane dimensions. An oversized component plane can therefore make unc_encoder_component_interleave::encode_tile() copy attacker-controlled data beyond the heap output buffer. This issue is fixed in version 1.23.2.
- Product
- libheif
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026libheif is a HEIF and AVIF file format decoder and encoder.CVE-2026-84384 · Other software · strukturag · reported by GitHubHigh 7.5
libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.2, crafted HEIF or AVIF mime metadata and unci image data can cause decompress_brotli() and do_inflate() to grow accumulated output without an effective size limit or MemoryHandle accounting. The brotli path has no output bound, while the zlib path checks only a small temporary buffer in a branch that valid streams do not reach, and overlapping icef units can decompress the same payload repeatedly. HeifContext::interpret_heif_file_images() processes multiple compressed metadata items during file opening, allowing a small file to consume unbounded memory and terminate the process. This issue is fixed in version 1.23.2.
- Product
- libheif
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026libheif is a HEIF and AVIF file format decoder and encoder.CVE-2026-84383 · Other software · strukturag · reported by GitHubCritical 9.8
libheif is a HEIF and AVIF file format decoder and encoder. From 1.22.0 until 1.23.2, a crafted HEIF, HEIC, or AVIF item graph using nested iden and auxl references can make HeifPixelImage::transfer_channel_from_image_as() append duplicate Alpha planes with different bit depths to m_storage. HeifPixelImage::scale_nearest_neighbor() in libheif/image/pixelimage.cc allocates the destination Alpha plane using the first plane's 8-bit depth, then iterates a later 10-bit or 12-bit Alpha component and writes uint16_t samples into the same 8-bit allocation. The output geometry controls the overflow extent and the encoded sample values control the data written, allowing a remote file processed by heif_decode_image() to cause a heap out-of-bounds write. This issue is fixed in version 1.23.2.
- Product
- libheif
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026libheif is a HEIF and AVIF file format decoder and encoder.CVE-2026-62377 · Other software · strukturag · reported by GitHubMedium 4.3
libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF sequence accepted by heif_context_read_from_memory() can leave the context with no registered sequence tracks and crash when heif_context_get_track(ctx, 0) is called. HeifContext::get_track() in libheif/context.cc executes assert(has_sequence()) before its normal error handling, so assert-enabled builds abort instead of allowing the public wrapper in libheif/api/libheif/heif_sequences.cc to return null. In release builds, removing the assertion lets the track_id zero path dereference m_tracks.begin()->second on an empty map, which is undefined behavior and typically crashes. The issue is reachable through documented public APIs after parsing attacker-controlled bytes. This issue is fixed in version 1.23.1.
- Product
- libheif
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026libheif is a HEIF and AVIF file format decoder and encoder.CVE-2026-62292 · Other software · strukturag · reported by GitHubHigh 8.7
libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.1, a crafted uncompressed HEIF image using generic zlib unci full-item compression can crash an application that decodes an advertised tile with heif_image_handle_decode_image_tile(). In libheif/codecs/uncompressed/unc_decoder.cc, unc_decoder::fetch_tile_data() computes a large tile offset and unc_decoder::get_compressed_image_data_uncompressed() validates it with range_start_offset plus range_size. For the last advertised tile (4095, 4095), the addition can wrap to zero, bypass the bounds check, and pass an invalid source pointer and a one-terabyte length to memcpy. The observed result is an out-of-bounds read and process crash; opening the file alone does not trigger the issue because tile decoding is required. This issue is fixed in version 1.23.1.
- Product
- libheif
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026libheif is a HEIF and AVIF file format decoder and encoder.CVE-2026-62291 · Other software · strukturag · reported by GitHubMedium 5.3
libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted image sequence with a 2x2 primary plane and a 256x256 auxiliary alpha plane can cause attacker-controlled heap corruption during a normal decode and re-encode workflow. Track_Visual::decode_next_image_sample() calls transfer_channel_from_image_as() without checking that the auxiliary alpha dimensions match the main frame. The resulting inconsistent image reaches heif_track_decode_next_image() and then heif_context_encode_image(). In unc_encoder::encode(), unc_encoder_component_interleave::encode_tile() sizes its buffer with compute_tile_data_size_bytes() using the primary dimensions but copies each component using its actual plane dimensions. The oversized alpha plane is therefore copied beyond the allocation, causing an out-of-bounds write; the inverse size mismatch can also produce an out-of-bounds read. This issue is fixed in version 1.23.1.
- Product
- libheif
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026libheif is a HEIF and AVIF file format decoder and encoder.CVE-2026-62289 · Other software · strukturag · reported by GitHubMedium 4.3
libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF or AVIF file containing a clean aperture box can reduce an image dimension to zero and crash or corrupt tiling results when heif_image_handle_get_image_tiling(handle, 1, &tiling) is called. ImageItem::get_heif_image_tiling() returns already transformed dimensions, and process_image_transformations_on_tiling() applies the clean aperture transformation again. The second application passes zero to Box_clap::left_rounded(0), where image_width minus one underflows and constructs Fraction(0xFFFFFFFF, 2). Debug builds reach an assertion and abort, while release builds can return a corrupt crop and zero-width tiling result. The affected implementation spans libheif/image-items/image_item.cc, libheif/context.cc, and libheif/box.cc. This issue is fixed in version 1.23.1.
- Product
- libheif
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026libheif is a HEIF and AVIF file format decoder and encoder.CVE-2026-50142 · Other software · strukturag · reported by GitHubHigh 7.5
libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.0, a crafted HEIF sequence accepted by heif_context_read_from_memory() with the msf1 sequence brand can cause unbounded heap allocation. In libheif/sequences/seq_boxes.cc, Box_stsz::parse() applies max_sequence_frames only to variable-size samples, so fixed-size mode accepts an attacker-controlled sample_count without a bound. In libheif/sequences/track.cc, Track::load() also adds current_sample_idx and samples_per_chunk in 32-bit arithmetic, allowing the consistency check to be bypassed by wraparound. The resulting values reach the Chunk::Chunk() allocation path, which can consume gigabytes of memory and crash or stall the process through memory exhaustion. This issue is fixed in version 1.23.0.
- Product
- libheif
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2026libheif is a HEIF and AVIF file format decoder and encoder.CVE-2026-48029 · Other software · strukturag · reported by GitHubHigh 7.1
libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.19.0 through 1.21.2 have a heap OOB read in ImageItem_Grid::decode_grid_tile via irot-induced tile-coordinate underflow. Version 1.22.0 fixes the issue.
- Product
- libheif
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2026libheif is a HEIF and AVIF file format decoder and encoder.CVE-2026-47709 · Other software · strukturag · reported by GitHubMedium 6.9
libheif is a HEIF and AVIF file format decoder and encoder. Versions prior to 1.22.0 crashes in the public C API `heif_image_handle_get_image_tiling()` when a malformed uncompressed HEIF image item has an associated `uncC` property but no associated `ispe` property. In debug builds this trips the `ispe && uncC` assertion in `ImageItem_uncompressed::get_heif_image_tiling()`. In a release/NDEBUG ASan build, the same file causes a null pointer read at address `0xa8`. Version 1.22.0 fixes the issue.
- Product
- libheif
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2026libheif is a HEIF and AVIF file format decoder and encoder.CVE-2026-47254 · Other software · strukturag · reported by GitHubMedium 6.1
libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, `Track::init_sample_timing_table()` in `libheif/sequences/track.cc` stores an out-of-bounds chunk index (`m_chunks.size()`) into `m_presentation_timeline` when the number of chunks defined in the `stco` box is less than the number of samples in `stsz`. A subsequent call to `heif_track_get_next_raw_sequence_sample()` reads `m_chunks[chunk_idx]` with that OOB index, causing a heap-buffer-overflow. Version 1.22.0 fixes the issue.
- Product
- libheif
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2026libheif is a HEIF and AVIF file format decoder and encoder.CVE-2026-47251 · Other software · strukturag · reported by GitHubMedium 6.8
libheif is a HEIF and AVIF file format decoder and encoder. The fix for CVE-2026-3949 (commit `b97c8b5`, PR #1712) introduced an integer overflow in the very security check it added. The check itself can be bypassed, allowing a crafted HEIF file with a VVC track to trigger the same out-of-bounds heap read that CVE-2026-3949 was meant to prevent. This is a separate, currently-unpatched vulnerability. Issue #1712 was closed as fixed without testing the edge case where `size` is near `UINT32_MAX`. Version 1.22.0 patches the issue.
- Product
- libheif
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2026libheif is a HEIF and AVIF file format decoder and encoder.CVE-2026-47247 · WordPress plugins & themes · reported by GitHubHigh 7.5
libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, two bugs in libheif chain to leak process heap memory as visible pixel values in decoded grid images. An attacker who uploads a crafted AVIF/HEIC file to any server-side image processor (WordPress, Sharp/libvips, ImageMagick, etc.) can recover heap data - including library function pointers sufficient to defeat ASLR, or any other secret - from the publicly-downloadable transcoded JPEG/PNG/WebP output. Local attack vectors are also possible. Version 1.22.0 fixes the issue.
- What to do
- Update the plugin to the newest version.
Jul 21, 2026libheif is a HEIF and AVIF file format decoder and encoder.CVE-2026-47178 · Other software · strukturag · reported by GitHubMedium 6.1
libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.19.0 through 1.21.2, a crafted HEIF file (uncompressed `unci` codec, tiled, component-interleaved, 4:2:0) triggers a heap out-of-bounds write in libheif's uncompressed tile decoder. The write overwrites the C++ vtable pointer of an adjacent `unc_decoder_component_interleave` object; the next virtual call dispatches to an attacker-chosen address. Version 1.22.0 patches the issue.
- Product
- libheif
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2026libheif is a HEIF and AVIF file format decoder and encoder.CVE-2026-47714 · Other software · strukturag · reported by GitHubMedium 6.1
libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, the inline mask parsing code in `libheif/region.cc` contains an integer overflow. Both `width` and `height` are `unsigned int` (32-bit) values parsed from the HEIF file. Their product can exceed `UINT32_MAX`, wrapping to a small value before the division by 8. This causes an undersized buffer allocation, leading to out-of-bounds memory access when the mask data is later interpreted as a `width x height` bitmap. Version 1.22.0 patches the issue.
- Product
- libheif
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 19, 2026libheif is a HEIF and AVIF file format decoder and encoder.CVE-2026-49271 · Other software · strukturag · reported by GitHubMedium 6.5
libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.1, the uncompressed HEIF decoder validates explicit icef compressed-unit offsets using unit_offset + unit_size. Because the addition can wrap, a crafted HEIF file can pass the range check and then construct a vector from iterators outside the compressed item buffer, producing an out-of-bounds heap read and crash. Version 1.22.1 patches the issue.
- Product
- libheif
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2026libheif is a HEIF and AVIF file format decoder and encoder.CVE-2026-41071 · Other software · strukturag · reported by GitHubMedium 5.1
libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, a crafted HEIF sequence file where the saiz box declares more samples than actually exist in the track's chunk table causes a heap-buffer-overflow (out-of-bounds read) in the SampleAuxInfoReader constructor. The SampleAuxInfoReader constructor iterates over saiz->get_num_samples() samples but doesn't validate that this count is consistent with the number of chunks in the chunks vector. When saiz declares more samples than the chunks cover, the loop increments current_chunk past chunks.size(), causing an out-of-bounds read on the chunks vector. The vulnerability is triggered during file parsing (heif_context_read_from_file) without any additional user interaction. Any application using libheif to open untrusted HEIF files is affected. This issue has been fixed in version 1.22.0.
- Product
- libheif
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2026libheif is a HEIF and AVIF file format decoder and encoder.CVE-2026-41069 · Other software · strukturag · reported by GitHubMedium 6.5
libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, a malformed HEIF sequence file can trigger an out-of-bounds read in core sequence parsing logic, causing DoS. A malformed file can have stco.entry_count == 0 (creating no chunks) while still passing validation because saio.entry_count == 0 matches, but with saiz.sample_count > 0 the SampleAuxInfoReader constructor still enters its loop. This leads to an out-of-bounds dereference on the empty chunks[0] in chunked mode.
- Product
- libheif
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 19, 2026libheif is a HEIF and AVIF file format decoder and encoder.CVE-2026-32882 · Other software · strukturag · reported by GitHubHigh 7.1
libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.21.2 and prior contain a heap buffer over-read in HeifPixelImage::overlay() in libheif/pixelimage.cc. When compositing an overlay image (iovl) whose child image has a different bit depth for the alpha channel than for the color channels, the function indexes into the alpha plane using the color channel stride (in_stride) instead of the previously retrieved alpha_stride, causing reads past the end of the alpha buffer (up to 3,123 bytes for a 100×50 image with 10-bit color and 8-bit alpha). A crafted HEIF file can exploit this to cause a denial of service (crash) or potentially disclose adjacent heap memory through leaked bytes embedded in the decoded output pixels. This issue has been fixed in versionThis issue has been fixed in version 1.22.0.
- Product
- libheif
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 19, 2026libheif is a HEIF and AVIF file format decoder and encoder.CVE-2026-32814 · Other software · strukturag · reported by GitHubMedium 6.5
libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, when decoding a HEIF grid image with strict_decoding=false (the default), a corrupted tile silently fails to decode and the library returns heif_error_Ok with no indication of failure, leading to an uninitialized heap memory information leak. The canvas is allocated via create_clone_image_at_new_size() → plane.alloc() → new (std::nothrow) uint8_t[allocation_size] which does not zero the memory; only the alpha plane is explicitly initialized via fill_plane(), so the Y, Cb, and Cr planes contain whatever was previously at that heap address. The failed tile's region of the canvas is never written. It retains uninitialized heap data that is delivered to the caller as decoded pixel values (4,096 bytes per Y/Cb/Cr plane = 12,288+ bytes total). Any application using libheif to decode grid-based HEIF/AVIF files with default settings is vulnerable: a crafted .heic or .avif file causes 4,096+ bytes of heap memory to appear as pixel values in the decoded image, and the calling application receives heif_error_Ok, so it has no indication the output contains heap garbage. In server-side image processing, an
- Product
- libheif
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 19, 2026libheif is a HEIF and AVIF file format decoder and encoder.CVE-2026-32741 · Other software · strukturag · reported by GitHubHigh 7.1
libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.21.2 and below contain a heap buffer overflow in MaskImageCodec::decode_mask_image(). When decoding a HEIF file containing a mask image (mski), the function copies the full iloc extent data into a pixel buffer using memcpy(dst, data.data(), data.size()). The copy length data.size() is determined by the iloc extent in the file (attacker-controlled), while the destination buffer is sized based on the declared image dimensions. Because no upper-bound check exists on the data length, a crafted file whose iloc extent exceeds the pixel buffer allocation overflows the heap. The vulnerable single-memcpy branch is reached when the mskC property specifies bits_per_pixel = 8 and the ispe property declares an even width ≥ 64 (so that stride == width), with no changes to default security limits or external codec plugins required. This issue has been fixed in version 1.22.0.
- Product
- libheif
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 19, 2026libheif is a HEIF and AVIF file format decoder and encoder.CVE-2026-32740 · Other software · strukturag · reported by GitHubHigh 8.8
libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.21.2 and prior contain a heap-buffer-overflow (write) vulnerability in the grid tile compositing, allowing an attacker to write 64 bytes of fully attacker-controlled data past the end of a chroma plane heap allocation by crafting a HEIF/AVIF file with a 1×4 grid of odd-height tiles. The overflow is triggered during normal image decoding with default build configuration. The written bytes are chroma (Cb/Cr) pixel values from the attacking tile, giving the attacker full control over the overflow content. This issue has been fixed in version 1.22.0.
- Product
- libheif
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 19, 2026libheif is a HEIF and AVIF file format decoder and encoder.CVE-2026-32739 · Other software · strukturag · reported by GitHubMedium 6.5
libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and below, a crafted 800-byte HEIF sequence file causes an infinite loop in Box_stts::get_sample_duration(), consuming 100% CPU indefinitely with zero progress, leading to DoS. The loop has no iteration limit or timeout and is triggered during file open (parsing) - before any user interaction or image decoding. The process stays alive (no crash, no error logged), making it invisible to crash-based monitoring. This issue has been fixed in version 1.22.0.
- Product
- libheif
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 19, 2026libheif is a HEIF and AVIF file format decoder and encoder.CVE-2026-32738 · Other software · strukturag · reported by GitHubMedium 6.5
libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and below, a crafted 792-byte HEIF sequence file with samples_per_chunk=0 in the stsc box causes an unsigned integer underflow in the Chunk constructor (m_last_sample = 0 + 0 - 1 = UINT32_MAX), mapping all samples to an empty chunk and resulting in a denial of service. When any sample is accessed, the library reads from index 0 of an empty std::vector, causing a guaranteed SEGV (null-page read). The file parses successfully without producing an error; the crash occurs on the first frame access. This issue has been fixed in version 1.22.0.
- Product
- libheif
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2026A vulnerability was identified in strukturag libheif up to 1.21.2.CVE-2026-3950 · Other software · strukturag · reported by VulDBLow 1.9
A vulnerability was identified in strukturag libheif up to 1.21.2. This impacts the function Track::load of the file libheif/sequences/track.cc of the component stsz/stts. The manipulation leads to out-of-bounds read. The attack needs to be performed locally. The exploit is publicly available and might be used. Applying a patch is the recommended action to fix this issue. The patch available is inofficial and not approved yet.
- Product
- libheif
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2026A vulnerability was determined in strukturag libheif up to 1.21.2.CVE-2026-3949 · Other software · strukturag · reported by VulDBLow 1.9
A vulnerability was determined in strukturag libheif up to 1.21.2. This affects the function vvdec_push_data2 of the file libheif/plugins/decoder_vvdec.cc of the component HEIF File Parser. Executing a manipulation of the argument size can lead to out-of-bounds read. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. This patch is called b97c8b5f198b27f375127cd597a35f2113544d03. It is advisable to implement a patch to correct this issue.
- Product
- libheif
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2025libheif is an HEIF and AVIF file format decoder and encoder.CVE-2025-68431 · Other software · strukturag · reported by GitHubMedium 6.5
libheif is an HEIF and AVIF file format decoder and encoder. Prior to version 1.21.0, a crafted HEIF that exercises the overlay image item path triggers a heap buffer over-read in `HeifPixelImage::overlay()`. The function computes a negative row length (likely from an unclipped overlay rectangle or invalid offsets), which then underflows when converted to `size_t` and is passed to `memcpy`, causing a very large read past the end of the source plane and a crash. Version 1.21.0 contains a patch. As a workaround, avoid decoding images using `iovl` overlay boxes.
- Product
- libheif
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2025libheif before 1.19.6 has a NULL pointer dereference in ImageItem_Grid::get_decoder in image-items/grid.cc because a grid image can reference a nonexistent imagCVE-2025-43967 · Other software · struktur · reported by MITRELow 2.9
libheif before 1.19.6 has a NULL pointer dereference in ImageItem_Grid::get_decoder in image-items/grid.cc because a grid image can reference a nonexistent image item.
- Product
- libheif
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2025libheif before 1.19.6 has a NULL pointer dereference in ImageItem_iden in image-items/iden.cc.CVE-2025-43966 · Other software · struktur · reported by MITRELow 2.9
libheif before 1.19.6 has a NULL pointer dereference in ImageItem_iden in image-items/iden.cc.
- Product
- libheif
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2025Buffer Overflow vulnerability in libheif 1.19.7 allows a local attacker to execute arbitrary code via the SAO (Sample Adaptive Offset) processing of libde265.CVE-2025-29482 · Other software · Struktur · reported by MITREMedium 6.2
Buffer Overflow vulnerability in libheif 1.19.7 allows a local attacker to execute arbitrary code via the SAO (Sample Adaptive Offset) processing of libde265.
- Product
- Libheif
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2024In Libheif 1.17.6, insufficient checks in ImageOverlay::parse() decoding a heif file containing an overlay image with forged offsets can lead to an out-of-boundCVE-2024-41311 · Other software · struktur · reported by MITREHigh 8.1
In Libheif 1.17.6, insufficient checks in ImageOverlay::parse() decoding a heif file containing an overlay image with forged offsets can lead to an out-of-bounds read and write.
- Product
- libheif
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Mar 4, 2024libheif <= 1.17.6 contains a memory leak in the function JpegEncoder::Encode.CVE-2024-25269 · Other software · libheif · reported by MITREHigh 7.5
libheif <= 1.17.6 contains a memory leak in the function JpegEncoder::Encode. This flaw allows an attacker to cause a denial of service attack.
- Product
- libheif
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2023libheif v1.17.5 was discovered to contain a segmentation violation via the function UncompressedImageCodec::get_luma_bits_per_pixel_from_configuration_unci.CVE-2023-49464 · Other software · Struktur · reported by MITREHigh 8.8
libheif v1.17.5 was discovered to contain a segmentation violation via the function UncompressedImageCodec::get_luma_bits_per_pixel_from_configuration_unci.
- Product
- Libheif
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2023libheif v1.17.5 was discovered to contain a segmentation violation via the function find_exif_tag at /libheif/exif.cc.CVE-2023-49463 · Other software · Struktur · reported by MITREHigh 8.8
libheif v1.17.5 was discovered to contain a segmentation violation via the function find_exif_tag at /libheif/exif.cc.
- Product
- Libheif
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2023libheif v1.17.5 was discovered to contain a segmentation violation via the component /libheif/exif.cc.CVE-2023-49462 · Other software · Struktur · reported by MITREHigh 8.8
libheif v1.17.5 was discovered to contain a segmentation violation via the component /libheif/exif.cc.
- Product
- Libheif
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2023libheif v1.17.5 was discovered to contain a segmentation violation via the function UncompressedImageCodec::decode_uncompressed_image.CVE-2023-49460 · Other software · Struktur · reported by MITREHigh 8.8
libheif v1.17.5 was discovered to contain a segmentation violation via the function UncompressedImageCodec::decode_uncompressed_image.
- Product
- Libheif
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2023A Segmentation fault caused by a floating point exception exists in libheif 1.15.1 using crafted heif images via the heif::Fraction::round() function in box.cc,CVE-2023-29659 · Other software · Struktur · reported by MITREMedium 6.5
A Segmentation fault caused by a floating point exception exists in libheif 1.15.1 using crafted heif images via the heif::Fraction::round() function in box.cc, which causes a denial of service.
- Product
- Libheif
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.fedoraproject.org
Feb 23, 2023 There is a vulnerability in the strided image data parsing code in the emscripten wrapper for libheif.CVE-2023-0996 · Other software · Struktur · reported by cve_disclosure@tech.gov.sgHigh 7.8
There is a vulnerability in the strided image data parsing code in the emscripten wrapper for libheif. An attacker could exploit this through a crafted image file to cause a buffer overflow in linear memory during a memcpy call.
- Product
- libheif
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgovtech-csg.github.io
Nov 3, 2021Buffer overflow vulnerability in function convert_colorspace in heif_colorconversion.cc in libheif v1.6.2, allows attackers to cause a denial of service and disCVE-2020-23109 · Other software · Struktur · reported by MITREHigh 8.1
Buffer overflow vulnerability in function convert_colorspace in heif_colorconversion.cc in libheif v1.6.2, allows attackers to cause a denial of service and disclose sensitive information, via a crafted HEIF file.
- Product
- Libheif
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2021An issue was discovered in heif::Box_iref::get_references in libheif 1.4.0, allows attackers to cause a Denial of Service or possibly other unspecified impact dCVE-2020-19499 · Other software · Struktur · reported by MITREHigh 8.8
An issue was discovered in heif::Box_iref::get_references in libheif 1.4.0, allows attackers to cause a Denial of Service or possibly other unspecified impact due to an invalid memory read.
- Product
- Libheif
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2021Floating point exception in function Fraction in libheif 1.4.0, allows attackers to cause a Denial of Service or possibly other unspecified impacts.CVE-2020-19498 · Other software · Struktur · reported by MITREHigh 8.8
Floating point exception in function Fraction in libheif 1.4.0, allows attackers to cause a Denial of Service or possibly other unspecified impacts.
- Product
- Libheif
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 23, 2019libheif 1.4.0 has a use-after-free in heif::HeifContext::Image::set_alpha_channel in heif_context.h because heif_context.cc mishandles references to non-existinCVE-2019-11471 · Other software · Struktur · reported by MITREHigh 8.8
libheif 1.4.0 has a use-after-free in heif::HeifContext::Image::set_alpha_channel in heif_context.h because heif_context.cc mishandles references to non-existing alpha images.
- Product
- Libheif
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.