UbuntuUpdates.org

Package "libheif-dev"

Name: libheif-dev

Description:

HEIF and AVIF file format decoder and encoder - development files
Latest version: 1.21.2-3ubuntu0.7
Release: resolute (26.04)
Level: security
Repository: universe
Head package: libheif
Homepage: http://www.libheif.org

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "libheif-dev"

32-bit deb package
64-bit deb package
APT INSTALL

Other versions of "libheif-dev" in Resolute

Repository Area Version
base universe 1.21.2-3
updates universe 1.21.2-3ubuntu0.6

Changelog

Version: 1.21.2-3ubuntu0.7 2026-11-09 18:08:38 UTC

libheif (1.21.2-3ubuntu0.7) resolute-security; urgency=medium

  * SECURITY UPDATE: Buffer overflow in processTile
    - debian/patches/CVE-2026-120208-pre1.patch: add shared HEIF test-building
      helpers in tests/test_utils.h and tests/test_utils.cc
    - debian/patches/CVE-2026-120208.patch: Fix heap OOB write in
      libheif/codecs/uncompressed/decoder_abstract.cc,
      ../decoder_abstract.h and ../decoder_mixed_interleave.cc
    - CVE-2026-120208

 -- Kyle Kernick Wed, 04 Nov 2026 16:18:17 -0600
Source diff to previous version
CVE-2026-120208 libheif 1.18.0 before 1.23.3 contains a heap-based buffer overflow vulnerability in unc_decoder_mixed_interleave::processTile() that allows attackers

Version: 1.21.2-3ubuntu0.6 2026-09-29 18:07:23 UTC

libheif (1.21.2-3ubuntu0.6) resolute-security; urgency=medium

  * SECURITY UPDATE: Denial of service in HEIF or AVIF metadata parsing
    - debian/patches/CVE-2026-84384-pre1.patch: add
      HeifFile::get_security_limits() getter in libheif/file.h
    - debian/patches/CVE-2026-84384-pre2.patch: catch C++ exceptions at the
      read/decode C API entry points in libheif/api_structs.h,
      libheif/error.h, ../error.cc, libheif/api/libheif/heif_context.cc,
      ../heif_decoding.cc, ../heif_sequences.cc and ../heif_tiling.cc
    - debian/patches/CVE-2026-84384.patch: bound brotli/zlib decompression
      output in libheif/compression.h, ../compression_brotli.cc,
      ../compression_zlib.cc, ../context.cc, ../file.cc,
      libheif/image-items/image_item.h,
      libheif/codecs/uncompressed/decoder_abstract.cc, and
      ../decoder_abstract.h
    - CVE-2026-84384
  * SECURITY UPDATE: Denial of service in HEIF parsing
    - debian/patches/CVE-2026-84446-pre1.patch: add calloc-style
      MemoryHandle::alloc() overload with integer-overflow checking in
      libheif/security_limits.cc and ../security_limits.h
    - debian/patches/CVE-2026-84446-pre2.patch: add
      heif_track_get_number_of_repetitions() API and supporting helpers in
      libheif/api/libheif/heif_sequences.h, ../heif_sequences.cc,
      libheif/context.cc, ../context.h, libheif/sequences/seq_boxes.h,
      ../track.cc and ../track.h
    - debian/patches/CVE-2026-84446.patch: Fix sequence timing-table DoS in
      libheif/api/libheif/heif_sequences.cc, libheif/sequences/chunk.cc,
      ../chunk.h, ../seq_boxes.cc, ../seq_boxes.h, ../track.cc and ../track.h
    - CVE-2026-84446
  * SECURITY UPDATE: Unbound allocation in reference graphs
    - debian/patches/CVE-2026-84447.patch: Bound derived-image reference
      amplification in libheif/context.cc, ../context.h, ../file.cc,
      ../file.h, libheif/image-items/grid.cc, ../grid.h, ../iden.cc,
      libheif/image-items/iden.h, ../image_item.cc, ../image_item.h,
      ../mask_image.cc, ../mask_image.h, ../overlay.cc, ../overlay.h,
      ../tiled.cc, ../tiled.h, ../unc_image.cc, ../unc_image.h,
      libheif/security_limits.h
    - CVE-2026-84447
  * SECURITY UPDATE: Denial of service in
    heif_region_item_add_region_inline_mask_data
    - debian/patches/CVE-2026-84448-pre1.patch: advance the parse offset after
      inline mask data in libheif/region.cc
    - debian/patches/CVE-2026-84448.patch: Validate inline mask data length
      in region writer API in libheif/api/libheif/heif_regions.cc and
      ../heif_regions.h
    - CVE-2026-84448

 -- Kyle Kernick Thu, 24 Sep 2026 13:00:45 -0600
Source diff to previous version
CVE-2026-84384 libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.2, crafted HEIF or AVIF mime metadata and unci image data can caus
CVE-2026-84446 libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, crafted HEIF sequence timing and edit-list data can make Track::init_sam
CVE-2026-84447 libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.1 and earlier, crafted grid, iovl, and iden reference graphs can repeatedly decod
CVE-2026-84448 libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, the public heif_region_item_add_region_inline_mask_data() function in li

Version: 1.21.2-3ubuntu0.5 2026-09-16 18:07:33 UTC

libheif (1.21.2-3ubuntu0.5) resolute-security; urgency=medium

  * SECURITY UPDATE: Out-of-bounds write in decoder/encoder
    - debian/patches/CVE-2026-62291.patch: Reject uncompressed encode of
      images with mismatched component plane sizes in
      libheif/image-items/unc_image.cc and ../unc_image.h
    - CVE-2026-62291
  * SECURITY UPDATE: Denial of service in heif_context_read_from_memory
    - debian/patches/CVE-2026-62377.patch: Return error instead of asserting
      in libheif/context.cc
    - CVE-2026-62377

 -- Kyle Kernick Tue, 15 Sep 2026 11:03:16 -0600
Source diff to previous version
CVE-2026-62291 libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted image sequence with a 2x2 primary plane and a 256x256 au
CVE-2026-62377 libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF sequence accepted by heif_context_read_from_memory(

Version: 1.21.2-3ubuntu0.4 2026-08-19 15:09:48 UTC
No changelog available yet.
Source diff to previous version

Version: 1.21.2-3ubuntu0.3 2026-07-09 21:08:34 UTC

  libheif (1.21.2-3ubuntu0.3) resolute-security; urgency=medium

  * SECURITY UPDATE: Heap Buffer Overflow in Track::get_next_sample_raw_data
    - debian/patches/CVE-2026-47254-1.patch: Validate stsc sample coverage
      in libheif/sequences/track.cc
    - debian/patches/CVE-2026-47254-2.patch: add defensive check in
      init_sample_timing_table() in libheif/sequences/track.cc
    - CVE-2026-47254
  * SECURITY UPDATE: Integer overflow when parsing uncC.
    - debian/patches/CVE-2026-47709-1.patch: Prevent integer overflow
      when parsing uncC in libheif/codecs/uncompressed/unc_boxes.cc
    - debian/patches/CVE-2026-47709-2.patch: Reject unci images with no ispe
      box in libheif/image-items/unc_image.cc
    - CVE-2026-47709
  * SECURITY UPDATE: Integer overflow in inline mask size calculation
    - debian/patches/CVE-2026-47714.patch: Fix computation of size of inline
      region mask in libheif/region.cc
    - CVE-2026-47714
  * SECURITY UPDATE: OOB read in ImageItem_Grid::decode_grid_tile.
    - debian/patches/CVE-2026-48029.patch: Fix tile coordinates validation
      in rotated images in libheif/api/libheif/heif_tiling.cc and
      libheif/image-items/image_item.cc
    - CVE-2026-48029
  * SECURITY UPDATE: Unbounded heap allocation in sequence parser.
    - debian/patches/CVE-2026-50142.patch: Fix check against security limit
      in libheif/sequences/seq_boxes.cc and ../track.cc
    - CVE-2026-50142

 -- Kyle Kernick <email address hidden> Tue, 07 Jul 2026 12:04:31 -0600


About   -   Send Feedback to @ubuntu_updates