Approved changes feed: RSS · Atom
cpe:2.3:a:struktur:libheif:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Struktur (34d32917-61bc-5e1b-b86b-5b136ed7a1c8) |
|---|---|
| Product | Libheif (f20527f1-5965-5ed6-b5c9-a03c9d43f6bf) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:deb/debian/libheif |
purl2cpe | 2026-06-01 10:11:29.106270 |
pkg:deb/ubuntu/libheif |
purl2cpe | 2026-06-01 10:11:29.106272 |
pkg:github/strukturag/libheif |
purl2cpe | 2026-06-01 10:11:29.106274 |
pkg:rpm/opensuse/libheif |
purl2cpe | 2026-06-01 10:11:29.106275 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-68431 |
vulnerable | 2026-06-08 07:41:21.120161 |
libheif has Potential Heap Buffer Over-Read
MEDIUM (6.5)
libheif is an HEIF and AVIF file format decoder and encoder. Prior to version 1.21.0, a crafted HEIF that exercises the overlay image item path triggers a heap buffer over-read in `HeifPixelImage::overlay()`. The function computes a negative row length (likely from an unclipped overlay rectangle or invalid offsets), which then underflows when converted to `size_t` and is passed to `memcpy`, causing a very large read past the end of the source plane and a crash. Version 1.21.0 contains a patch. As a workaround, avoid decoding images using `iovl` overlay boxes.
Published: 2025-12-29T19:09:54.628Z
Updated: 2025-12-30T22:26:20.374Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-43967 |
vulnerable | 2026-06-08 07:25:10.513450 |
Details available
LOW (2.9)
libheif before 1.19.6 has a NULL pointer dereference in ImageItem_Grid::get_decoder in image-items/grid.cc because a grid image can reference a nonexistent image item.
Published: 2025-04-20T00:00:00.000Z
Updated: 2025-04-21T02:10:32.788Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-43966 |
vulnerable | 2026-06-08 07:25:10.513100 |
Details available
LOW (2.9)
libheif before 1.19.6 has a NULL pointer dereference in ImageItem_iden in image-items/iden.cc.
Published: 2025-04-20T00:00:00.000Z
Updated: 2025-04-21T02:11:39.099Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-25269 |
vulnerable | 2026-06-08 06:31:22.716248 |
Details available
libheif <= 1.17.6 contains a memory leak in the function JpegEncoder::Encode. This flaw allows an attacker to cause a denial of service attack.
Published: 2024-03-05T00:00:00.000Z
Updated: 2025-04-16T16:01:40.637Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-0996 |
vulnerable | 2026-06-08 05:52:33.593108 |
Details available
There is a vulnerability in the strided image data parsing code in the emscripten wrapper for libheif. An attacker could exploit this through a crafted image file to cause a buffer overflow in linear memory during a memcpy call.
Published: 2023-02-24T03:35:58.752Z
Updated: 2025-03-11T20:47:36.950Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.