Skip to content
Heist/ feed
Back to feed
UnratedFix available

Security update for libheif

Type: advisorySources: OSV

This update for libheif fixes the following issues: - CVE-2026-84449: hOp_RGB24_32_to_YCbCr Memory Access Error / SEGV (bsc#1281829). - AV1/libaom path allows allocation before libheif rejects mismatched coded dimensions (bsc#1281953). - Caller-configured security limits not enforced for MINI-box parsing (bsc#1281952). - Heap out-of-bounds read in libheif alpha compositing via mismatched per-channel bit depths (bsc#1281951). - Heap-use-after-free and double free in ImageItem::encode_to_bitstream_and_boxes (bsc#1281949). - Incomplete OpenJPEG pre-decode security limits allow unsafe decode through the public API (bsc#1281954). - JPEG 2000 pclr zero-column allocation amplification bypasses max_total_memory (bsc#1281950). - Out-of-bounds heap read in unc_encoder_rgb_pixel_interleave (bsc#1281948). Changes for libheif: - update to 1.23.5: * (GHSA-v8qw-hwjv-44hw) Memory exhaustion through a mismatch between the container and the bitstream image size. A crafted image can declare a small size in its ispe property while the bitstream declares a much larger coded frame. The container-level checks used the ispe size, so the oversized bitstream reached the decoder, which allocated a frame buffer for the in-band size before libheif rejected the mismatch. The advisory demonstrated this for AV1 with the libaom backend (a 351-byte AVIF declaring 64x64 but coding up to 27648x27648, allocating hundreds of MB to more than 10 GB), but the same class affects every codec whose real frame size live

Products
libheif
Affected versions
Not specified
Fixed versions
1.23.5-160000.1.1
CVEs
CVE-2020-6851, CVE-2026-84449
Confirmed fixed CVEs
Not specified
Updated in this feed
31 Oct 2026, 15:31 UTC · Revision 1

Source evidence

Security update for libheif

core-osv · Original source

Published 8 Oct 2026, 06:22 UTC

This update for libheif fixes the following issues: - CVE-2026-84449: hOp_RGB24_32_to_YCbCr Memory Access Error / SEGV (bsc#1281829). - AV1/libaom path allows allocation before libheif rejects mismatched coded dimensions (bsc#1281953). - Caller-configured security limits not enforced for MINI-box parsing (bsc#1281952). - Heap out-of-bounds read in libheif alpha compositing via mismatched per-channel bit depths (bsc#1281951). - Heap-use-after-free and double free in ImageItem::encode_to_bitstream_and_boxes (bsc#1281949). - Incomplete OpenJPEG pre-decode security limits allow unsafe decode through the public API (bsc#1281954). - JPEG 2000 pclr zero-column allocation amplification bypasses max_total_memory (bsc#1281950). - Out-of-bounds heap read in unc_encoder_rgb_pixel_interleave (bsc#1281948). Changes for libheif: - update to 1.23.5: * (GHSA-v8qw-hwjv-44hw) Memory exhaustion through a mismatch between the container and the bitstream image size. A crafted image can declare a small size in its ispe property while the bitstream declares a much larger coded frame. The container-level checks used the ispe size, so the oversized bitstream reached the decoder, which allocated a frame buffer for the in-band size before libheif rejected the mismatch. The advisory demonstrated this for AV1 with the libaom backend (a 351-byte AVIF declaring 64x64 but coding up to 27648x27648, allocating hundreds of MB to more than 10 GB), but the same class affects every codec whose real frame size live

osv:SUSE-SU-2026:24205-1

libheif

Fixed versions: 1.23.5-160000.1.1

libheif

Fixed versions: 1.23.5-160000.1.1

Complete source record
{
  "id": "1e0dbcb77681a34efec53ceb38f8ba3ca0f41be1ff89335d6cd36556f1bbe504",
  "url": "https://osv.dev/vulnerability/SUSE-SU-2026%3A24205-1",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Security update for libheif",
    "summary": "This update for libheif fixes the following issues: - CVE-2026-84449: hOp_RGB24_32_to_YCbCr Memory Access Error / SEGV (bsc#1281829). - AV1/libaom path allows allocation before libheif rejects mismatched coded dimensions (bsc#1281953). - Caller-configured security limits not enforced for MINI-box parsing (bsc#1281952). - Heap out-of-bounds read in libheif alpha compositing via mismatched per-channel bit depths (bsc#1281951). - Heap-use-after-free and double free in ImageItem::encode_to_bitstream_and_boxes (bsc#1281949). - Incomplete OpenJPEG pre-decode security limits allow unsafe decode through the public API (bsc#1281954). - JPEG 2000 pclr zero-column allocation amplification bypasses max_total_memory (bsc#1281950). - Out-of-bounds heap read in unc_encoder_rgb_pixel_interleave (bsc#1281948). Changes for libheif: - update to 1.23.5: * (GHSA-v8qw-hwjv-44hw) Memory exhaustion through a mismatch between the container and the bitstream image size. A crafted image can declare a small size in its ispe property while the bitstream declares a much larger coded frame. The container-level checks used the ispe size, so the oversized bitstream reached the decoder, which allocated a frame buffer for the in-band size before libheif rejected the mismatch. The advisory demonstrated this for AV1 with the libaom backend (a 351-byte AVIF declaring 64x64 but coding up to 27648x27648, allocating hundreds of MB to more than 10 GB), but the same class affects every codec whose real frame size live",
    "evidence": "osv:SUSE-SU-2026:24205-1",
    "products": [
      {
        "name": {
          "value": "libheif",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "1.23.5-160000.1.1",
            "evidence": "/affected/0/ranges"
          }
        ],
        "affected_versions": []
      },
      {
        "name": {
          "value": "libheif",
          "evidence": "/affected/1/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "1.23.5-160000.1.1",
            "evidence": "/affected/1/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "SUSE-SU-2026:24205-1",
      "aliases": [
        "SUSE-SU-2026:24205-1"
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "1.23.5-160000.1.1"
                }
              ]
            }
          ],
          "package": {
            "name": "libheif",
            "purl": "pkg:rpm/suse/libheif&distro=SUSE%20Linux%20Enterprise%20Server%2016.0",
            "ecosystem": "SUSE:Linux Enterprise Server 16.0"
          },
          "database_specific": {
            "source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:24205-1.json"
          },
          "ecosystem_specific": {
            "binaries": [
              {
                "libheif1": "1.23.5-160000.1.1",
                "libheif-aom": "1.23.5-160000.1.1",
                "libheif-jpeg": "1.23.5-160000.1.1",
                "libheif-dav1d": "1.23.5-160000.1.1",
                "libheif-rav1e": "1.23.5-160000.1.1",
                "libheif-ffmpeg": "1.23.5-160000.1.1",
                "libheif-svtenc": "1.23.5-160000.1.1",
                "libheif-openjpeg": "1.23.5-160000.1.1",
                "gdk-pixbuf-loader-libheif": "1.23.5-160000.1.1"
              }
            ]
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "1.23.5-160000.1.1"
                }
              ]
            }
          ],
          "package": {
            "name": "libheif",
            "purl": "pkg:rpm/suse/libheif&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0",
            "ecosystem": "SUSE:Linux Enterprise Server for SAP applications 16.0"
          },
          "database_specific": {
            "source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:24205-1.json"
          },
          "ecosystem_specific": {
            "binaries": [
              {
                "libheif1": "1.23.5-160000.1.1",
                "libheif-aom": "1.23.5-160000.1.1",
                "libheif-jpeg": "1.23.5-160000.1.1",
                "libheif-dav1d": "1.23.5-160000.1.1",
                "libheif-rav1e": "1.23.5-160000.1.1",
                "libheif-ffmpeg": "1.23.5-160000.1.1",
                "libheif-svtenc": "1.23.5-160000.1.1",
                "libheif-openjpeg": "1.23.5-160000.1.1",
                "gdk-pixbuf-loader-libheif": "1.23.5-160000.1.1"
              }
            ]
          }
        }
      ],
      "modified": "2026-10-21T17:23:09.187019175Z",
      "provider": "osv",
      "upstream": [
        "CVE-2020-6851",
        "CVE-2026-84449"
      ],
      "references": [
        "https://www.suse.com/support/update/announcement/2026/suse-su-202624205-1/",
        "https://bugzilla.suse.com/1281829",
        "https://bugzilla.suse.com/1281948",
        "https://bugzilla.suse.com/1281949",
        "https://bugzilla.suse.com/1281950",
        "https://bugzilla.suse.com/1281951",
        "https://bugzilla.suse.com/1281952",
        "https://bugzilla.suse.com/1281953",
        "https://bugzilla.suse.com/1281954",
        "https://www.suse.com/security/cve/CVE-2020-6851",
        "https://www.suse.com/security/cve/CVE-2026-84449"
      ]
    },
    "related_cves": [
      {
        "value": "CVE-2020-6851",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-84449",
        "evidence": "/upstream"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 397539,
  "published_at": "2026-10-08T06:22:54+00:00"
}