Summary
Ali Firas discovered that libheif incorrectly handled certain images. An
attacker could possibly use this issue to cause a denial of service or
execute arbitrary code. (CVE-2026-62291)
Dmitrijs Trizna discovered that libheif incorrectly handled certain image
sequences. An attacker could possibly use this issue to cause a denial of
service. (CVE-2026-62377)
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 26.04 LTS 26.04:LTS | libheif | 1.21.2-3ubuntu0.5 |
Vulnerabilities 2
-
Medium 5.3
libheif: Heap out of bounds write in libheif uncompressed encoder when writing images with mismatched auxiliary alpha dimensions
libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted image sequence with a 2x2 primary plane and a 256x256 auxiliary alpha plane can cause attacker-controlled heap corruption during a normal decode and re-encode workflo…
-
Medium 4.3
libheif: Reachable assertion in HeifContext::get_track() aborts on a valid-but-empty HEIF sequence file (context.cc:2110)
libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF sequence accepted by heif_context_read_from_memory() can leave the context with no registered sequence tracks and crash when heif_context_get_track(ctx, 0) is ca…