#image-parsing

0 stories this week · 1 this month · 9 in 6 months · mostly security

Stories per day · 30 days

9 stories, newest first · one card per story

libpng 1.6.59 fixes use-after-free CVE-2026-46675; its release tarball is now available.

Perl Imager before 1.037 exits when a raw image has an out-of-range raw_datachannels value.

GBHackersSep 21, 2026high

Hacktron's "HEIF Heist" research shows memory-unsafe HEIF/AVIF parsers enable RCE and data leaks in Slack, Meta, GitHub Enterprise, and OpenAI.

Hanno Böck flags a security-relevant libheif fix (GHSA-v8qw-hwjv-44hw) rejecting oversized in-band coded image sizes, absent from release 1.23.4.

Multiple new security advisories affect the libheif and libde265 codecs; users should verify versions against the published fixes.

WordfenceSep 18, 2026high

Wordfence Argus disclosed a critical CVSS 9.8 flaw in libheif enabling protected-file disclosure and code execution on vulnerable server deployments.

The DecoderSep 18, 2026high

Hacktron researchers used Claude Opus 5 to exploit libheif and an SSO flaw, taking over OpenAI employee ChatGPT and Codex accounts within 72 hours.

Perl module Imager::File::PNG before 1.004 writes past the end of the row buffer when reading PNGs with a tRNS transparency chunk.

Ubuntu patches libheif image-parsing flaws allowing denial of service or arbitrary code execution (CVE-2026-62291, CVE-2026-62377).

Stories tagged #image-parsing