Multiple security advisories for libheif and libde265; size-validation fix (GHSA-v8qw-hwjv-44hw) missing from libheif 1.23.4

Recent advisories affect the strukturag libheif and libde265 HEIF/HEVC decoding libraries, and users are urged to verify installed versions. One security-relevant libheif issue, GHSA-v8qw-hwjv-44hw, allows crafted images to understate their coded size via the…

An oss-security post by Alan Coopersmith (2026-09-18) highlights numerous new security advisories published over the past few months for libheif and libde265, the open-source strukturag libraries widely used to decode HEIF/HEVC images, urging anyone using these codecs to check their installed versions against the vendor advisories. The post also notes that the related heif-heist.com site is more promotional than informational. In a follow-up (2026-09-19), Hanno Böck flagged a security-relevant libheif fix tracked as GHSA-v8qw-hwjv-44hw: commit 6ce2bba in strukturag/libheif rejects in-band coded image sizes exceeding the security limit for all codecs. A crafted image can declare a small size in its container 'ispe' property while the actual coded image is larger, bypassing prior validation. Notably, this fix was not included in the libheif 1.23.4 release, so users on that version remain exposed to this issue and should check the advisories for patched versions.

• Multiple new security advisories were published over the past few months for strukturag's libheif and libde265, open-source libraries widely used for HEIF/HEVC image decoding.
• The advisories were highlighted on oss-security by Alan Coopersmith on 2026-09-18, with users urged to check installed versions against the vendor advisories.
• GHSA-v8qw-hwjv-44hw: libheif's size validation weakness applies across codecs; crafted HEIF images can declare a small size in the 'ispe' property while the actual coded image is larger, bypassing prior validation.
• The fix for GHSA-v8qw-hwjv-44hw is commit 6ce2bba in strukturag/libheif, which rejects in-band coded image sizes exceeding the security limit for all codecs.
• The fix was not included in the libheif 1.23.4 release, per Hanno Böck's oss-security follow-up on 2026-09-19.
• The heif-heist.com campaign site related to these vulnerabilities is described as promotional rather than informational.