libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.19.6, Op_RGB24_32_to_YCbCr::convert_colorspace() stores image-plane strides in an integer width that can overflow for extremely large RGB images created through heif_image_create() and heif_image_add_plane(). The resulting wrapped stride causes the conversion loop in libheif/color-conversion/rgb2yuv.cc to compute an invalid input pointer and read beyond the allocated interleaved plane while heif_context_encode_image() performs RGB-to-YCbCr conversion. This can crash the encoding process. This issue is fixed in version 1.19.6.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade libheif | Sep 21, 2026 | Sep 18, 2026 |
| Ubuntu | — | Upgrade libheif1 (Ubuntu Pro)Upgrade heif-gdk-pixbufUpgrade libheif-plugin-j2kencUpgrade heif-thumbnailerUpgrade heif-viewUpgrade libheif-plugin-aomencUpgrade libheif-devUpgrade libheif-plugin-j2kdecUpgrade libheif-plugin-rav1eUpgrade libheif-plugin-kvazaarUpgrade libheif1Upgrade libheif-plugin-jpegdecUpgrade libheif-plugin-dav1dUpgrade libheif-plugin-aomdecUpgrade libheif-plugin-svtencUpgrade libheif-plugin-x265Upgrade libheif-plugin-libde265Upgrade libheif-dev (Ubuntu Pro)Upgrade libheif-plugin-ffmpegdecUpgrade libheif-plugins-allUpgrade heif-gdk-pixbuf (Ubuntu Pro)Upgrade libheif-plugin-jpegencUpgrade heif-thumbnailer (Ubuntu Pro) | Oct 6, 2026 | Sep 29, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub