Summary
It was discovered that libheif did not correctly handle certain memory
operations. An attacker could possibly use this issue to cause a denial
of service. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS
and Ubuntu 24.04 LTS. (CVE-2024-25269)
Aldo Ristori discovered that libheif did not correctly handle certain
memory operations. An attacker could possibly use this issue to cause a
denial of service or execute arbitrary code. (CVE-2025-68431)
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 24.04 LTS 24.04:LTS | libheif | 1.17.6-1ubuntu4.2 |
| Ubuntu · 25.10 | libheif | 1.20.2-1ubuntu0.1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | libheif | 1.1.0-2ubuntu0.1~esm2 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | libheif | 1.6.1-1ubuntu0.1~esm2 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | libheif | 1.12.0-2ubuntu0.1~esm2 |
Vulnerabilities 2
-
High 7.5
libheif <= 1.17.6 contains a memory leak in the function JpegEncoder::Encode. This flaw allows an attacker to cause a d…
-
Medium 6.5
libheif has Potential Heap Buffer Over-Read
libheif is an HEIF and AVIF file format decoder and encoder. Prior to version 1.21.0, a crafted HEIF that exercises the overlay image item path triggers a heap buffer over-read in `HeifPixelImage::overlay()`. The function computes a negative row length (likel…