| Bug | bookworm | trixie | forky | sid | Description |
|---|
| TEMP-1148137-089975 | vulnerable | fixed | fixed | fixed | GHSA-xrp2-63fq-jm8q: Unbounded iref entry list and unbounded recursion in the reference-cycle check crash the parser |
| TEMP-1148137-126A7B | vulnerable | fixed | fixed | fixed | GHSA-vg7w-rp49-4fc2: The max_items security limit is not enforced for iinf child boxes |
| TEMP-0000000-FDE8B2 | vulnerable | fixed | fixed | fixed | GHSA-vv35-6hxg-95x8: Decoded image can have another bit depth than the image handle reports |
| TEMP-0000000-F2B97A | vulnerable | fixed | fixed | fixed | GHSA-v8qw-hwjv-44hw: AV1/libaom path allows allocation before libheif rejects mismatched coded dimensions |
| TEMP-0000000-E83054 | vulnerable | vulnerable | vulnerable | vulnerable | GHSA-2g6j-vhr6-6wrj |
| TEMP-0000000-DB3DE2 | vulnerable | fixed | fixed | fixed | GHSA-qwpf-5wf7-r996: Heap-use-after-free and double free in ImageItem::encode_to_bitstream_and_boxes (shallow copy of ImageDescription::m_tai_timestamp) |
| TEMP-0000000-D2EEB5 | vulnerable | fixed | fixed | fixed | GHSA-86ch-j429-fpr2: HEVC size limits can be skipped before decoding with the FFmpeg decoder plugin |
| TEMP-0000000-C86CAF | vulnerable | vulnerable | vulnerable | vulnerable | GHSA-7qm8-hj35-269r |
| TEMP-0000000-C11E78 | vulnerable | vulnerable | vulnerable | vulnerable | GHSA-xwcv-cp39-m2w4 |
| TEMP-0000000-BBE297 | vulnerable | fixed | fixed | fixed | GHSA-w7mc-p8jc-p853: heap OOB read / info disclosure (Op_YCbCr420_to_RRGGBBaa |
| TEMP-0000000-809756 | vulnerable | fixed | fixed | fixed | GHSA-3gwx-cjv4-jr74: Reachable assertion when decoding a grid image with an alpha plane of more than 16 bits |
| TEMP-0000000-177737 | vulnerable | vulnerable | vulnerable | vulnerable | GHSA-73j7-gvm9-x8q6 |
| TEMP-0000000-153207 | vulnerable | vulnerable (no DSA) | vulnerable | vulnerable | GHSA-vr5j-9r89-725x: CPU amplification in unci decode path surviving GHSA-24wx-9w62-c96w fix |
| TEMP-0000000-81967A | vulnerable | vulnerable | vulnerable | vulnerable | GHSA-hhg3-fxg7-3gxw |
| TEMP-0000000-25573F | vulnerable | vulnerable | vulnerable | vulnerable | GHSA-fpr5-xpfr-vcq3 |
| TEMP-0000000-9465BB | vulnerable | vulnerable | vulnerable | vulnerable | GHSA-jx54-6rm6-2cgj |
| TEMP-0000000-9253BB | vulnerable | fixed | fixed | fixed | GHSA-hqpw-h8p6-22q9: Heap out-of-bounds read in the FFmpeg decoder plugin: input passed to av_parser_parse2() without padding |
| TEMP-0000000-5124DE | vulnerable | fixed | fixed | fixed | GHSA-hvwh-xpj6-ph5x: Error message used after free in heif-enc input loaders |
| TEMP-0000000-956D99 | vulnerable | fixed | fixed | fixed | GHSA-9c75-9g8r-4728: JPEG 2000 pclr zero-column allocation amplification bypasses max_total_memory |
| TEMP-0000000-625D50 | vulnerable | vulnerable | vulnerable | vulnerable | GHSA-rcqc-842v-m26h |
| TEMP-0000000-415AE1 | vulnerable | fixed | fixed | fixed | GHSA-6fqc-p7r8-2g36: CPU amplification: a generically compressed `unci` item is decompressed once per tile |
| TEMP-0000000-301DE5 | vulnerable | fixed | fixed | fixed | GHSA-q7mw-2fmm-5q94: Out-of-bounds read in libsharpyuv through sample values above the image's bit depth |
| TEMP-0000000-98A003 | vulnerable | vulnerable | vulnerable | vulnerable | GHSA-48p4-gj45-w9v6 |
| TEMP-0000000-78AC20 | vulnerable | fixed | fixed | fixed | GHSA-4jqm-2x34-6f6r: Heap buffer overflow in SVT-AV1 encoder for high-bit-depth alpha channels |
| TEMP-0000000-75D4C4 | vulnerable | vulnerable | vulnerable | vulnerable | GHSA-hpg4-g2gc-pq42 |
| TEMP-0000000-57F868 | vulnerable | fixed | fixed | fixed | GHSA-8p2c-9wv4-rx4p: NULL pointer dereference in `Track_Visual::decode_next_image_sample()` when a sequence chunk references a non-visual sample entry |
| TEMP-0000000-35A060 | vulnerable | vulnerable | vulnerable | vulnerable | GHSA-9rpf-2x22-78m9 |
| TEMP-0000000-21F713 | vulnerable | fixed | fixed | fixed | GHSA-7pwf-qh74-p35w: Caller-configured security limits not enforced for MINI-box parsing |
| TEMP-0000000-18A2CE | vulnerable | fixed | fixed | fixed | GHSA-r7gr-2xm2-23wf: Heap out-of-bounds read in libheif alpha compositing via mismatched per-channel bit depths (uncompressed codec) |
| TEMP-0000000-16F469 | vulnerable | vulnerable | vulnerable | vulnerable | GHSA-pfcm-ffqg-84hx |
| TEMP-0000000-8A4B18 | vulnerable | fixed | fixed | fixed | GHSA-fcmw-5764-7rq8: Decompressed `unci` tile data escapes the memory budget in the `cmpC` `image_tile` branch |
| TEMP-0000000-7FD9AF | vulnerable | vulnerable | vulnerable | vulnerable | GHSA-35mc-3887-rr37 |
| TEMP-0000000-6C5194 | vulnerable | fixed | fixed | fixed | GHSA-v5rj-g4wv-j5w3: Uncompressed codec returns chroma samples above the declared bit depth in mixed interleave mode |
| TEMP-0000000-4EF776 | vulnerable | fixed | fixed | fixed | GHSA-9rj8-5mp5-26c9: Out-of-bounds read in RGB-YCbCr identity-matrix colour conversion with mismatched per-channel bit depths |
| TEMP-0000000-1FC908 | vulnerable | vulnerable | vulnerable | vulnerable | GHSA-gff5-3vgr-p8h2 |
| TEMP-0000000-1B5D39 | vulnerable | fixed | fixed | fixed | GHSA-h4h8-qgvc-m7r2: OpenJPEG decoder: tile and component counts of a JPEG 2000 codestream cause allocations of several gigabytes regardless of the security limits |
| TEMP-0000000-0F03E5 | vulnerable | fixed | fixed | fixed | GHSA-qfj5-c4pq-q998: Out-of-bounds heap read in unc_encoder_rgb_pixel_interleave when an alpha plane is attached to an image whose chroma format carries no alpha |
| TEMP-0000000-0A1CC5 | vulnerable | vulnerable | vulnerable | vulnerable | GHSA-74mj-m37q-h3q9 |
| CVE-2026-120208 | vulnerable | fixed | fixed | fixed | libheif 1.18.0 before 1.23.3 contains a heap-based buffer overflow vul ... |
| CVE-2026-84451 | vulnerable | fixed | fixed | fixed | libheif is a HEIF and AVIF file format decoder and encoder. From 1.19. ... |
| CVE-2026-84450 | vulnerable | fixed | fixed | fixed | libheif is a HEIF and AVIF file format decoder and encoder. From 1.19. ... |
| CVE-2026-84449 | vulnerable | fixed | fixed | fixed | libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1 ... |
| CVE-2026-84448 | vulnerable | fixed | fixed | fixed | libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1 ... |
| CVE-2026-84447 | vulnerable | fixed | fixed | fixed | libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.1 ... |
| CVE-2026-84446 | vulnerable | fixed | fixed | fixed | libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1 ... |
| CVE-2026-84444 | vulnerable | fixed | fixed | fixed | libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1 ... |
| CVE-2026-84384 | vulnerable | fixed | fixed | fixed | libheif is a HEIF and AVIF file format decoder and encoder. From 1.19. ... |
| CVE-2026-62292 | vulnerable | fixed | fixed | fixed | libheif is a HEIF and AVIF file format decoder and encoder. From 1.19. ... |
| CVE-2026-62289 | vulnerable | fixed | fixed | fixed | libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 ... |
| CVE-2026-50142 | vulnerable | fixed | fixed | fixed | libheif is a HEIF and AVIF file format decoder and encoder. From 1.19. ... |
| CVE-2026-49271 | vulnerable | fixed | fixed | fixed | libheif is a HEIF and AVIF file format decoder and encoder. Prior to v ... |
| CVE-2026-48029 | vulnerable | fixed | fixed | fixed | libheif is a HEIF and AVIF file format decoder and encoder. Versions 1 ... |
| CVE-2026-47714 | vulnerable | fixed | fixed | fixed | libheif is a HEIF and AVIF file format decoder and encoder. In version ... |
| CVE-2026-47709 | vulnerable | fixed | fixed | fixed | libheif is a HEIF and AVIF file format decoder and encoder. Versions p ... |
| CVE-2026-47254 | vulnerable | fixed | fixed | fixed | libheif is a HEIF and AVIF file format decoder and encoder. Prior to v ... |
| CVE-2026-47247 | vulnerable | fixed | fixed | fixed | libheif is a HEIF and AVIF file format decoder and encoder. Prior to v ... |
| CVE-2026-47178 | vulnerable | fixed | fixed | fixed | libheif is a HEIF and AVIF file format decoder and encoder. In version ... |
| CVE-2026-41071 | vulnerable | fixed | fixed | fixed | libheif is a HEIF and AVIF file format decoder and encoder. In version ... |
| CVE-2026-41069 | vulnerable | fixed | fixed | fixed | libheif is a HEIF and AVIF file format decoder and encoder. In version ... |
| CVE-2026-32882 | vulnerable | fixed | fixed | fixed | libheif is a HEIF and AVIF file format decoder and encoder. Versions 1 ... |
| CVE-2026-32814 | vulnerable | fixed | fixed | fixed | libheif is a HEIF and AVIF file format decoder and encoder. In version ... |
| CVE-2026-32741 | vulnerable | fixed | fixed | fixed | libheif is a HEIF and AVIF file format decoder and encoder. Versions 1 ... |
| CVE-2026-32740 | vulnerable | fixed | fixed | fixed | libheif is a HEIF and AVIF file format decoder and encoder. Versions 1 ... |
| CVE-2026-32739 | vulnerable | fixed | fixed | fixed | libheif is a HEIF and AVIF file format decoder and encoder. In version ... |
| CVE-2026-32738 | vulnerable | fixed | fixed | fixed | libheif is a HEIF and AVIF file format decoder and encoder. In version ... |
| CVE-2025-68431 | vulnerable (no DSA) | fixed | fixed | fixed | libheif is an HEIF and AVIF file format decoder and encoder. Prior to ... |