Summary
Yuqi Qiu and Xiang Li discovered that libheif incorrectly handled certain
compressed metadata. A remote attacker could possibly use this issue to
cause a denial of service. This issue only affected Ubuntu 24.04 LTS and
Ubuntu 26.04 LTS. (CVE-2026-84384)
Yuqi Qiu and Xiang Li discovered that libheif incorrectly handled certain
HEIF sequence data. A remote attacker could possibly use this issue to
cause a denial of service. This issue only affected Ubuntu 26.04 LTS.
(CVE-2026-84446)
Yuqi Qiu and Xiang Li discovered that libheif incorrectly handled certain
image references. A remote attacker could possibly use this issue to
cause a denial of service. This issue only affected Ubuntu 26.04 LTS.
(CVE-2026-84447)
It was discovered that libheif incorrectly handled certain region masks.
A local attacker could possibly use this issue to obtain sensitive
information or cause a denial of service. This issue only affected Ubuntu
24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-84448)
It was discovered that libheif incorrectly handled certain images. A
remote attacker could possibly use this issue to cause a denial of
service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS,
Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. (CVE-2026-84449)
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 24.04 LTS 24.04:LTS | libheif | 1.17.6-1ubuntu4.9 |
| Ubuntu · 26.04 LTS 26.04:LTS | libheif | 1.21.2-3ubuntu0.6 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | libheif | 1.1.0-2ubuntu0.1~esm5 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | libheif | 1.6.1-1ubuntu0.1~esm5 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | libheif | 1.12.0-2ubuntu0.1~esm5 |
Vulnerabilities 5
-
High 7.5
libheif: brotli/zlib decompression paths lack output-size limits, allowing decompression-bomb OOM/DoS
libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.2, crafted HEIF or AVIF mime metadata and unci image data can cause decompress_brotli() and do_inflate() to grow accumulated output without an effective size limit or MemoryHan…
-
High 7.5
libheif: Sequence decode timing-table initialization allows non-terminating loops and unbounded memory, bypassing max_sequence_frames
libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, crafted HEIF sequence timing and edit-list data can make Track::init_sample_timing_table() compute a logical m_num_output_samples value that exceeds the uint32_t counters used by Tra…
-
High 7.5
libheif: Derived-image indirect reference chains and tiled offsets bypass decode caching and MemoryHandle limits, causing CPU/memory amplification DoS
libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.1 and earlier, crafted grid, iovl, and iden reference graphs can repeatedly decode the same base image because processed_ids is copied per branch and ImageItem::decode_image() has no shared o…
-
Medium 4.0
libheif: Heap out-of-bounds read in libheif inline-mask region API (heif_region_item_add_region_inline_mask_data / heif_region_get_mask_image)
libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, the public heif_region_item_add_region_inline_mask_data() function in libheif/api/libheif/heif_regions.cc accepts mask_data_len without verifying that it equals the byte count requir…
-
Low 3.7
libheif hOp_RGB24_32_to_YCbCr Memory Access Error / SEGV
libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.19.6, Op_RGB24_32_to_YCbCr::convert_colorspace() stores image-plane strides in an integer width that can overflow for extremely large RGB images created through heif_image_create() and hei…