Summary
It was discovered that libheif had an integer underflow in the Fraction
constructor when a clap transform was applied twice. An attacker could
possibly use this issue to cause libheif to crash, resulting in a denial of
service. (CVE-2026-62289)
It was discovered that libheif had an out-of-bounds read in uncompressed
tile range slicing. An attacker could possibly use this issue to cause
libheif to crash, resulting in a denial of service. This issue only
affected Ubuntu 25.10. (CVE-2026-62292)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 24.04 LTS 24.04:LTS | libheif | 1.17.6-1ubuntu4.7 |
| Ubuntu · 26.04 LTS 26.04:LTS | libheif | 1.21.2-3ubuntu0.4 |