Re: Vulnerabilities in libheif and libde265
libheif 1.23.5 ships security fixes as the underfunded libheif and libde265 project cites 61 advisories.
Hanno Böck told the oss-security list that libheif released version 1.23.5 with various security fixes. The project's September 2026 status note says libheif and libde265 are maintained by one independent developer with almost no recurring funding. That maintainer has had to investigate and fix 61 security advisories. The message links the GitHub release notes but does not list CVE identifiers.
- libheif v1.23.5 includes multiple security fixes.
- libheif and libde265 rely on one independent maintainer.
- The project cites 61 security advisories needing investigation and fixes.
- The posted excerpt does not name individual CVE identifiers.
- Vendors
- strukturag
From the original article
Posted by Hanno Böck on Sep 22 libheif has released another update with various security fixes: https://github. com/strukturag/libheif/releases/tag/v1. 23.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.