libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.2, crafted HEIF or AVIF mime metadata and unci image data can cause decompress_brotli() and do_inflate() to grow accumulated output without an effective size limit or MemoryHandle accounting. The brotli path has no output bound, while the zlib path checks only a small temporary buffer in a branch that valid streams do not reach, and overlapping icef units can decompress the same payload repeatedly. HeifContext::interpret_heif_file_images() processes multiple compressed metadata items during file opening, allowing a small file to consume unbounded memory and terminate the process. This issue is fixed in version 1.23.2.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade libheif | Sep 30, 2026 | Sep 18, 2026 |
| Ubuntu | — | Upgrade libheif-plugin-jpegencUpgrade libheif-devUpgrade libheif-plugin-x265Upgrade libheif-plugin-dav1dUpgrade heif-viewUpgrade libheif-dev (Ubuntu Pro)Upgrade libheif-plugin-aomdecUpgrade libheif-plugin-jpegdecUpgrade heif-thumbnailer (Ubuntu Pro)Upgrade libheif-plugin-j2kdecUpgrade libheif-plugin-j2kencUpgrade heif-gdk-pixbufUpgrade libheif-plugin-ffmpegdecUpgrade libheif1 (Ubuntu Pro)Upgrade libheif-plugin-kvazaarUpgrade heif-gdk-pixbuf (Ubuntu Pro)Upgrade heif-thumbnailerUpgrade libheif-plugin-svtencUpgrade libheif1Upgrade libheif-plugin-aomencUpgrade libheif-plugin-rav1eUpgrade libheif-plugins-allUpgrade libheif-plugin-libde265 | Oct 6, 2026 | Sep 29, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub