Security update for libheif
This update for libheif fixes the following issues: - AV1/libaom path allows allocation before libheif rejects mismatched coded dimensions (bsc#1281953). - Caller-configured security limits not enforced for MINI-box parsing (bsc#1281952). - Heap out-of-bounds read in libheif alpha compositing via mismatched per-channel bit depths (bsc#1281951). - Heap-use-after-free and double free in ImageItem::encode_to_bitstream_and_boxes (bsc#1281949). - Incomplete OpenJPEG pre-decode security limits allow unsafe decode through the public API (bsc#1281954). - JPEG 2000 pclr zero-column allocation amplification bypasses max_total_memory (bsc#1281950). - Out-of-bounds heap read in unc_encoder_rgb_pixel_interleave (bsc#1281948). Changes for libheif: Update to 1.23.5: * (GHSA-v8qw-hwjv-44hw) Memory exhaustion through a mismatch between the container and the bitstream image size. A crafted image can declare a small size in its ispe property while the bitstream declares a much larger coded frame. The container-level checks used the ispe size, so the oversized bitstream reached the decoder, which allocated a frame buffer for the in-band size before libheif rejected the mismatch. The advisory demonstrated this for AV1 with the libaom backend (a 351-byte AVIF declaring 64x64 but coding up to 27648x27648, allocating hundreds of MB to more than 10 GB), but the same class affects every codec whose real frame size lives in the bitstream. The coded size is now checked against max_image_size_pixels in t
SUSE-SU-2026:4378-1
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:SUSE-SU-2026:4378-1
libheif
Source reference: /affected/0/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 1.23.5-150700.3.24.1
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
libheif
Source reference: /affected/1/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 1.23.5-150700.3.24.1
Source reference:
/affected/1/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.23.5-150700.3.24.1"
}
]
}
],
"package": {
"name": "libheif",
"purl": "pkg:rpm/suse/libheif&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Desktop%20Applications%2015%20SP7",
"ecosystem": "SUSE:Linux Enterprise Module for Desktop Applications 15 SP7"
},
"database_specific": {
"source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4378-1.json"
},
"ecosystem_specific": {
"binaries": [
{
"libheif1": "1.23.5-150700.3.24.1",
"libheif-aom": "1.23.5-150700.3.24.1",
"libheif-jpeg": "1.23.5-150700.3.24.1",
"libheif-dav1d": "1.23.5-150700.3.24.1",
"libheif-rav1e": "1.23.5-150700.3.24.1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.23.5-150700.3.24.1"
}
]
}
],
"package": {
"name": "libheif",
"purl": "pkg:rpm/suse/libheif&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP7",
"ecosystem": "SUSE:Linux Enterprise Module for Package Hub 15 SP7"
},
"database_specific": {
"source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4378-1.json"
},
"ecosystem_specific": {
"binaries": [
{
"libheif-devel": "1.23.5-150700.3.24.1",
"libheif-ffmpeg": "1.23.5-150700.3.24.1",
"gdk-pixbuf-loader-libheif": "1.23.5-150700.3.24.1"
}
]
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #25908 · Revision 1
- Added to Heist Feed
- Publisher date