What’s Vulnerable › Products
strukturag libheif vulnerabilities
48 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 36 published in the last 12 months.
Check whether your strukturag libheif version is affected
Latest strukturag libheif vulnerabilities
- CVE-2026-84451 — libheif: Incomplete fix for CVE-2026-62292 leaves libheif vulnerable to an out-of-bounds read (CVSS 6.5)
- CVE-2026-84450 — libheif: `clap` + oversized `ispe` aborts on an assert in `Fraction::Fraction` (incomplete fix for CVE-2026-62289) (CVSS 4.3)
- CVE-2026-84449 — libheif hOp_RGB24_32_to_YCbCr Memory Access Error / SEGV (CVSS 3.7)
- CVE-2026-84448 — libheif: Heap out-of-bounds read in libheif inline-mask region API (heif_region_item_add_region_inline_mask_data / heif_region_get_mask_image) (CVSS 4.0)
- CVE-2026-84447 — libheif: Derived-image indirect reference chains and tiled offsets bypass decode caching and MemoryHandle limits, causing CPU/memory amplification DoS (CVSS 7.5)
- CVE-2026-84446 — libheif: Sequence decode timing-table initialization allows non-terminating loops and unbounded memory, bypassing max_sequence_frames (CVSS 7.5)
- CVE-2026-84444 — libheif uncompressed tiled image encoding allows out-of-bounds write (CVSS 7.4)
- CVE-2026-84384 — libheif: brotli/zlib decompression paths lack output-size limits, allowing decompression-bomb OOM/DoS (CVSS 7.5)
- CVE-2026-84383 — libheif: Heap buffer overflow in `scale_nearest_neighbor()` via duplicate Alpha planes from nested `iden`/`auxl` items (CVSS 9.8)
- CVE-2026-62377 — libheif: Reachable assertion in HeifContext::get_track() aborts on a valid-but-empty HEIF sequence file (context.cc:2110) (CVSS 4.3)
- CVE-2026-62292 — libheif: Out-of-bounds read in uncompressed unci tile range slicing (CVSS 8.7)
- CVE-2026-62291 — libheif: Heap out of bounds write in libheif uncompressed encoder when writing images with mismatched auxiliary alpha dimensions (CVSS 5.3)
- CVE-2026-62289 — libheif: Integer underflow in Fraction constructor via double clap transform application (CVSS 4.3)
- CVE-2026-50142 — libheif: unbounded heap allocation in HEIF sequence parser (stsz fixed-size mode missing bound check) (CVSS 7.5)
- CVE-2026-48029 — libheif: heap OOB read in ImageItem_Grid::decode_grid_tile via irot-induced tile-coordinate underflow (CVSS 7.1)
- CVE-2026-47709 — libheif has a NULL pointer dereference in heif_image_handle_get_image_tiling for malformed unci image missing ispe (CVSS 5.5)
- CVE-2026-47254 — libheif Has Heap Buffer Overflow in `Track::get_next_sample_raw_data()` -- OOB Chunk Vector Access (CVSS 6.1)
- CVE-2026-47251 — libheif has an incomplete fix for CVE-2026-3949: integer overflow bypass in vvdec_push_data2 (CVSS 6.1)
- CVE-2026-47247 — libheif Vulnerable to Heap Information Disclosure via Grid Image Gap + Uninitialized Pixel Plane Allocation (CVSS 7.5)
- CVE-2026-47178 — libheif has Heap Out Of Bounds Write in unci subsystem (CVSS 7.8)
- CVE-2026-47714 — libheif has integer overflow in inline mask size calculation that causes undersized buffer allocation (CVSS 6.1)
- CVE-2026-49271 — libheif: Wrapped icef compressed-unit range check causes out-of-bounds read in uncompressed HEIF decoder (CVSS 6.5)
- CVE-2026-41071 — libheif: Heap buffer over-read in SampleAuxInfoReader via crafted HEIF sequence file with mismatched saiz sample count (CVSS 8.1)
- CVE-2026-41069 — libheif allows Out-of-bounds vector access leading to invalid dereference (DoS) (CVSS 6.5)
- CVE-2026-32882 — libheif: Heap Buffer OOB Read in overlay compositing due to wrong alpha stride (CVSS 7.1)