Skip to content
OpenAdvisories
High USN-9012-1 1 CVE

libheif vulnerability

Published Nov 9, 2026 · Updated Nov 11, 2026

Ecosystem: Ubuntu

Summary

Alex Thomas discovered that libheif incorrectly handled certain HEIF
images. An attacker could possibly use this issue to execute arbitrary code
if a user or automated system were tricked into opening a specially crafted
file.

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 26.04 LTS 26.04:LTS libheif 1.21.2-3ubuntu0.7

Vulnerabilities 1

  • High 7.5
    CVE-2026-120208

    libheif 1.18.0 before 1.23.3 Heap Buffer Overflow via unci Mixed-Interleave Decoder

    libheif 1.18.0 before 1.23.3 contains a heap-based buffer overflow vulnerability in unc_decoder_mixed_interleave::processTile() that allows attackers to write out of bounds by supplying chroma components with unequal bit depths. Attackers can craft a HEIF fil…

    strukturag libheif libheif libheif Debian Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2026-120208