libheif can run code from crafted HEIF images
Ubuntu says opening a malicious HEIF file, by a user or automated system, could lead to arbitrary code execution.
Stories per day · 30 days
2 RSS
8 stories, newest first · one card per story
Stories tagged #heif
USN-8846-1: libheif vulnerabilities
Ubuntu USN-8846-1 patches libheif flaws allowing remote denial of service via crafted metadata and HEIF data.
Re: Vulnerabilities in libheif and libde265
libheif 1.23.5 ships security fixes as the underfunded libheif and libde265 project cites 61 advisories.
HEIF Heist
Hacktron's HEIF Heist research reveals RCE and heap-leak vulnerabilities in libheif/libde265 HEIF/AVIF decoders, affecting Meta, OpenAI, GitHub Enterprise, Discourse, and Next.js.
Re: Vulnerabilities in libheif and libde265
Hanno Böck flags a security-relevant libheif fix (GHSA-v8qw-hwjv-44hw) rejecting oversized in-band coded image sizes, absent from release 1.23.4.
Vulnerabilities in libheif and libde265
Multiple new security advisories affect the libheif and libde265 codecs; users should verify versions against the published fixes.
USN-8774-1: libheif vulnerabilities
Ubuntu patches libheif image-parsing flaws allowing denial of service or arbitrary code execution (CVE-2026-62291, CVE-2026-62377).
USN-8755-1: libvips vulnerability
Ubuntu patches libvips flaw where crafted TIFF images converted to HEIF cause a crash, enabling denial of service.