strukturag libheif
34 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-120208 | 1.18.0 – < 1.23.3 | libheif 1.18.0 before 1.23.3 Heap Buffer Overflow via unci Mixed-Interleave Decoder | HIGH 7.7 | 0.4 % | ||
| CVE-2026-84450 | >= 1.19.0, < 1.23.3 | libheif: `clap` + oversized `ispe` aborts on an assert in `Fraction::Fraction` (incomplete fix for CVE-2026-62289) | MEDIUM 4.3 | 0.3 % | ||
| CVE-2026-84449 | < 1.19.6 | libheif hOp_RGB24_32_to_YCbCr Memory Access Error / SEGV | LOW 3.7 | 0.4 % | ||
| CVE-2026-84451 | >= 1.19.0, < 1.23.3 | libheif: Incomplete fix for CVE-2026-62292 leaves libheif vulnerable to an out-of-bounds read | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-84447 | < 1.23.2 | libheif: Derived-image indirect reference chains and tiled offsets bypass decode caching and MemoryHandle limits, causing CPU/memory ampl… | HIGH 7.5 | 0.5 % | ||
| CVE-2026-84384 | >= 1.19.0, < 1.23.2 | libheif: brotli/zlib decompression paths lack output-size limits, allowing decompression-bomb OOM/DoS | HIGH 7.5 | 0.5 % | ||
| CVE-2026-84444 | < 1.23.2 | libheif uncompressed tiled image encoding allows out-of-bounds write | HIGH 7.4 | 0.5 % | ||
| CVE-2026-84383 | >= 1.22.0, < 1.23.2 | libheif: Heap buffer overflow in `scale_nearest_neighbor()` via duplicate Alpha planes from nested `iden`/`auxl` items | CRITICAL 9.8 | 0.7 % | ||
| CVE-2026-84446 | < 1.23.2 | libheif: Sequence decode timing-table initialization allows non-terminating loops and unbounded memory, bypassing max_sequence_frames | HIGH 7.5 | 0.5 % | ||
| CVE-2026-84448 | < 1.23.2 | libheif: Heap out-of-bounds read in libheif inline-mask region API (heif_region_item_add_region_inline_mask_data / heif_region_get_mask_i… | MEDIUM 4.0 | 0.2 % | ||
| CVE-2026-62377 | < 1.23.1 | libheif: Reachable assertion in HeifContext::get_track() aborts on a valid-but-empty HEIF sequence file (context.cc:2110) | MEDIUM 4.3 | 0.4 % | ||
| CVE-2026-62291 | < 1.23.1 | libheif: Heap out of bounds write in libheif uncompressed encoder when writing images with mismatched auxiliary alpha dimensions | MEDIUM 5.3 | 0.2 % | ||
| CVE-2026-62292 | >= 1.19.0, < 1.23.1 | libheif: Out-of-bounds read in uncompressed unci tile range slicing | HIGH 8.7 | 0.6 % | ||
| CVE-2026-62289 | < 1.23.1 | libheif: Integer underflow in Fraction constructor via double clap transform application | MEDIUM 4.3 | 0.3 % | ||
| CVE-2026-50142 | >= 1.19.0, < 1.23.0 | libheif: unbounded heap allocation in HEIF sequence parser (stsz fixed-size mode missing bound check) | HIGH 7.5 | 0.7 % | ||
| CVE-2026-48029 | >= 1.19.0, < 1.22.0 | libheif: heap OOB read in ImageItem_Grid::decode_grid_tile via irot-induced tile-coordinate underflow | HIGH 7.1 | 0.4 % | ||
| CVE-2026-47709 | < 1.22.0 | libheif has a NULL pointer dereference in heif_image_handle_get_image_tiling for malformed unci image missing ispe | MEDIUM 6.9 | 0.2 % | ||
| CVE-2026-47254 | < 1.22.0 | libheif Has Heap Buffer Overflow in `Track::get_next_sample_raw_data()` -- OOB Chunk Vector Access | MEDIUM 6.1 | 0.2 % | ||
| CVE-2026-47251 | < 1.22.0 | libheif has an incomplete fix for CVE-2026-3949: integer overflow bypass in vvdec_push_data2 | MEDIUM 6.8 | 0.2 % | ||
| CVE-2026-47247 | < 1.22.0 | libheif Vulnerable to Heap Information Disclosure via Grid Image Gap + Uninitialized Pixel Plane Allocation | HIGH 7.5 | 0.5 % | ||
| CVE-2026-47178 | >= 1.19.0, < 1.22.0 | libheif has Heap Out Of Bounds Write in unci subsystem | HIGH 7.8 | 0.2 % | ||
| CVE-2026-47714 | < 1.22.0 | libheif has integer overflow in inline mask size calculation that causes undersized buffer allocation | MEDIUM 6.1 | 0.2 % | ||
| CVE-2026-49271 | < 1.22.1 | libheif: Wrapped icef compressed-unit range check causes out-of-bounds read in uncompressed HEIF decoder | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-41071 | < 1.22.0 | libheif: Heap buffer over-read in SampleAuxInfoReader via crafted HEIF sequence file with mismatched saiz sample count | MEDIUM 5.1 | 0.3 % | ||
| CVE-2026-41069 | < 1.22.0 | libheif allows Out-of-bounds vector access leading to invalid dereference (DoS) | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-32882 | < 1.22.0 | libheif: Heap Buffer OOB Read in overlay compositing due to wrong alpha stride | HIGH 7.1 | 0.7 % | ||
| CVE-2026-32741 | < 1.22.0 | libheif has a heap buffer overflow in decode_mask_image() | HIGH 7.1 | 0.3 % | ||
| CVE-2026-32814 | < 1.22.0 | libheif: Uninitialized Heap Memory Information Leak via Failed Grid Tiles | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-32740 | < 1.22.0 | libheif: Heap-Buffer-Overflow Write in Grid Tile Chroma Compositing | HIGH 8.8 | 0.7 % | ||
| CVE-2026-32739 | < 1.22.0 | libheif is Vulnerable to Infinite Loop DoS via stts Sample Duration Lookup | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-32738 | < 1.22.0 | libheif has a Heap OOB Read/SEGV Crash via Zero samples_per_chunk | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-3950 | 1.21.0 ; 1.21.1 ; 1.21.2 | strukturag libheif stsz/stts track.cc load out-of-bounds | MEDIUM 4.8 | 0.1 % | ||
| CVE-2026-3949 | 1.21.0 ; 1.21.1 ; 1.21.2 | strukturag libheif HEIF File decoder_vvdec.cc vvdec_push_data2 out-of-bounds | MEDIUM 4.8 | 0.1 % | ||
| CVE-2025-68431 | < 1.21.0 | libheif has Potential Heap Buffer Over-Read | HIGH 7.1 | 0.4 % |