The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, the inline mask parsing code in `libheif/region.cc` contains an integer overflow. Both `width` and `height` are `unsigned int` (32-bit) values parsed from the HEIF file. Their product can exceed `UINT32_MAX`, wrapping to a small value before the division by 8. This causes an undersized buffer allocation, leading to out-of-bounds memory access when the mask data is later interpreted as a `width x height` bitmap. Version 1.22.0 patches the issue.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade libheif-toolsUpgrade libheifUpgrade heif-pixbuf-loader-debuginfoUpgrade libheif-debugsourceUpgrade libheif-develUpgrade libheif-tools-debuginfoUpgrade heif-pixbuf-loaderUpgrade libheif-debuginfo | Jul 22, 2026 | Jul 21, 2026 |
| Debian | — | Upgrade libheif | Aug 9, 2026 | Aug 9, 2026 |
| Ubuntu | — | Upgrade libheif-plugins-allUpgrade libheif-plugin-svtencUpgrade libheif-plugin-x265Upgrade libheif-plugin-jpegencUpgrade libheif-plugin-libde265Upgrade libheif-plugin-ffmpegdecUpgrade libheif-plugin-aomdecUpgrade libheif-devUpgrade heif-viewUpgrade libheif-plugin-jpegdecUpgrade heif-gdk-pixbufUpgrade libheif1Upgrade libheif-plugin-j2kdecUpgrade libheif-plugin-aomencUpgrade heif-thumbnailerUpgrade libheif-examplesUpgrade libheif-plugin-kvazaarUpgrade libheif-plugin-j2kencUpgrade libheif-plugin-dav1dUpgrade libheif-plugin-rav1e | Jul 12, 2026 | Jul 9, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub