agentprime: strukturag-libheifEvery new CVE for strukturag-libheif.https://agentprime.io/CVE-2026-120208: libheif 1.18.0 before 1.23.3 Heap Buffer Overflow via unci Mixed-Interleave Decoderhttps://agentprime.io/advisories/CVE-2026-120208/https://agentprime.io/advisories/CVE-2026-120208/CVSS 7.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Sat, 31 Oct 2026 17:25:55 GMTCVECVE-2026-84450: libheif: `clap` + oversized `ispe` aborts on an assert in `Fraction::Fraction` (incomplete fix for CVE-2026-62289)https://agentprime.io/advisories/CVE-2026-84450/https://agentprime.io/advisories/CVE-2026-84450/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 18 Sep 2026 16:04:54 GMTCVECVE-2026-84449: libheif hOp_RGB24_32_to_YCbCr Memory Access Error / SEGVhttps://agentprime.io/advisories/CVE-2026-84449/https://agentprime.io/advisories/CVE-2026-84449/CVSS 3.7 (Low). Published by the CVE Program. Not analysed by agentprime yet.Fri, 18 Sep 2026 16:03:28 GMTCVECVE-2026-84451: libheif: Incomplete fix for CVE-2026-62292 leaves libheif vulnerable to an out-of-bounds readhttps://agentprime.io/advisories/CVE-2026-84451/https://agentprime.io/advisories/CVE-2026-84451/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 18 Sep 2026 16:02:22 GMTCVECVE-2026-84447: libheif: Derived-image indirect reference chains and tiled offsets bypass decode caching and MemoryHandle limits, causing CPU/memory amplification DoShttps://agentprime.io/advisories/CVE-2026-84447/https://agentprime.io/advisories/CVE-2026-84447/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 18 Sep 2026 16:00:51 GMTCVECVE-2026-84384: libheif: brotli/zlib decompression paths lack output-size limits, allowing decompression-bomb OOM/DoShttps://agentprime.io/advisories/CVE-2026-84384/https://agentprime.io/advisories/CVE-2026-84384/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 18 Sep 2026 15:58:21 GMTCVECVE-2026-84444: libheif uncompressed tiled image encoding allows out-of-bounds writehttps://agentprime.io/advisories/CVE-2026-84444/https://agentprime.io/advisories/CVE-2026-84444/CVSS 7.4 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 18 Sep 2026 15:56:41 GMTCVECVE-2026-84383: libheif: Heap buffer overflow in `scale_nearest_neighbor()` via duplicate Alpha planes from nested `iden`/`auxl` itemshttps://agentprime.io/advisories/CVE-2026-84383/https://agentprime.io/advisories/CVE-2026-84383/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Fri, 18 Sep 2026 15:55:46 GMTCVEcriticalCVE-2026-84446: libheif: Sequence decode timing-table initialization allows non-terminating loops and unbounded memory, bypassing max_sequence_frameshttps://agentprime.io/advisories/CVE-2026-84446/https://agentprime.io/advisories/CVE-2026-84446/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 18 Sep 2026 15:54:48 GMTCVECVE-2026-84448: libheif: Heap out-of-bounds read in libheif inline-mask region API (heif_region_item_add_region_inline_mask_data / heif_region_get_mask_image)https://agentprime.io/advisories/CVE-2026-84448/https://agentprime.io/advisories/CVE-2026-84448/CVSS 4.0 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 18 Sep 2026 15:53:42 GMTCVECVE-2026-62377: libheif: Reachable assertion in HeifContext::get_track() aborts on a valid-but-empty HEIF sequence file (context.cc:2110)https://agentprime.io/advisories/CVE-2026-62377/https://agentprime.io/advisories/CVE-2026-62377/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 18 Aug 2026 21:22:29 GMTCVECVE-2026-62291: libheif: Heap out of bounds write in libheif uncompressed encoder when writing images with mismatched auxiliary alpha dimensionshttps://agentprime.io/advisories/CVE-2026-62291/https://agentprime.io/advisories/CVE-2026-62291/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 18 Aug 2026 21:21:32 GMTCVECVE-2026-62292: libheif: Out-of-bounds read in uncompressed unci tile range slicinghttps://agentprime.io/advisories/CVE-2026-62292/https://agentprime.io/advisories/CVE-2026-62292/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 18 Aug 2026 21:20:24 GMTCVECVE-2026-62289: libheif: Integer underflow in Fraction constructor via double clap transform applicationhttps://agentprime.io/advisories/CVE-2026-62289/https://agentprime.io/advisories/CVE-2026-62289/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 18 Aug 2026 21:19:18 GMTCVECVE-2026-50142: libheif: unbounded heap allocation in HEIF sequence parser (stsz fixed-size mode missing bound check)https://agentprime.io/advisories/CVE-2026-50142/https://agentprime.io/advisories/CVE-2026-50142/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 18 Aug 2026 21:18:03 GMTCVECVE-2026-48029: libheif: heap OOB read in ImageItem_Grid::decode_grid_tile via irot-induced tile-coordinate underflowhttps://agentprime.io/advisories/CVE-2026-48029/https://agentprime.io/advisories/CVE-2026-48029/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 22 Jul 2026 14:13:27 GMTCVECVE-2026-47709: libheif has a NULL pointer dereference in heif_image_handle_get_image_tiling for malformed unci image missing ispehttps://agentprime.io/advisories/CVE-2026-47709/https://agentprime.io/advisories/CVE-2026-47709/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 21 Jul 2026 21:31:14 GMTCVECVE-2026-47254: libheif Has Heap Buffer Overflow in `Track::get_next_sample_raw_data()` -- OOB Chunk Vector Accesshttps://agentprime.io/advisories/CVE-2026-47254/https://agentprime.io/advisories/CVE-2026-47254/CVSS 6.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 21 Jul 2026 21:21:41 GMTCVECVE-2026-47251: libheif has an incomplete fix for CVE-2026-3949: integer overflow bypass in vvdec_push_data2https://agentprime.io/advisories/CVE-2026-47251/https://agentprime.io/advisories/CVE-2026-47251/CVSS 6.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 21 Jul 2026 21:18:56 GMTCVECVE-2026-47247: libheif Vulnerable to Heap Information Disclosure via Grid Image Gap + Uninitialized Pixel Plane Allocationhttps://agentprime.io/advisories/CVE-2026-47247/https://agentprime.io/advisories/CVE-2026-47247/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 21 Jul 2026 21:16:59 GMTCVECVE-2026-47178: libheif has Heap Out Of Bounds Write in unci subsystemhttps://agentprime.io/advisories/CVE-2026-47178/https://agentprime.io/advisories/CVE-2026-47178/CVSS 6.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 21 Jul 2026 21:09:10 GMTCVECVE-2026-47714: libheif has integer overflow in inline mask size calculation that causes undersized buffer allocationhttps://agentprime.io/advisories/CVE-2026-47714/https://agentprime.io/advisories/CVE-2026-47714/CVSS 6.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 21 Jul 2026 21:04:06 GMTCVECVE-2026-49271: libheif: Wrapped icef compressed-unit range check causes out-of-bounds read in uncompressed HEIF decoderhttps://agentprime.io/advisories/CVE-2026-49271/https://agentprime.io/advisories/CVE-2026-49271/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 19 Jun 2026 17:16:20 GMTCVECVE-2026-41071: libheif: Heap buffer over-read in SampleAuxInfoReader via crafted HEIF sequence file with mismatched saiz sample counthttps://agentprime.io/advisories/CVE-2026-41071/https://agentprime.io/advisories/CVE-2026-41071/CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 22 May 2026 20:59:09 GMTCVECVE-2026-41069: libheif allows Out-of-bounds vector access leading to invalid dereference (DoS)https://agentprime.io/advisories/CVE-2026-41069/https://agentprime.io/advisories/CVE-2026-41069/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 22 May 2026 20:49:16 GMTCVECVE-2026-32882: libheif: Heap Buffer OOB Read in overlay compositing due to wrong alpha stridehttps://agentprime.io/advisories/CVE-2026-32882/https://agentprime.io/advisories/CVE-2026-32882/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 19 May 2026 20:07:21 GMTCVECVE-2026-32741: libheif has a heap buffer overflow in decode_mask_image()https://agentprime.io/advisories/CVE-2026-32741/https://agentprime.io/advisories/CVE-2026-32741/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 19 May 2026 19:57:26 GMTCVECVE-2026-32814: libheif: Uninitialized Heap Memory Information Leak via Failed Grid Tileshttps://agentprime.io/advisories/CVE-2026-32814/https://agentprime.io/advisories/CVE-2026-32814/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 19 May 2026 19:49:23 GMTCVECVE-2026-32740: libheif: Heap-Buffer-Overflow Write in Grid Tile Chroma Compositinghttps://agentprime.io/advisories/CVE-2026-32740/https://agentprime.io/advisories/CVE-2026-32740/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 19 May 2026 19:22:07 GMTCVECVE-2026-32739: libheif is Vulnerable to Infinite Loop DoS via stts Sample Duration Lookuphttps://agentprime.io/advisories/CVE-2026-32739/https://agentprime.io/advisories/CVE-2026-32739/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 19 May 2026 19:10:03 GMTCVECVE-2026-32738: libheif has a Heap OOB Read/SEGV Crash via Zero samples_per_chunkhttps://agentprime.io/advisories/CVE-2026-32738/https://agentprime.io/advisories/CVE-2026-32738/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 19 May 2026 19:03:48 GMTCVECVE-2026-3950: strukturag libheif stsz/stts track.cc load out-of-boundshttps://agentprime.io/advisories/CVE-2026-3950/https://agentprime.io/advisories/CVE-2026-3950/CVSS 4.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 11 Mar 2026 19:02:08 GMTCVECVE-2026-3949: strukturag libheif HEIF File decoder_vvdec.cc vvdec_push_data2 out-of-boundshttps://agentprime.io/advisories/CVE-2026-3949/https://agentprime.io/advisories/CVE-2026-3949/CVSS 4.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 11 Mar 2026 18:32:09 GMTCVECVE-2025-68431: libheif has Potential Heap Buffer Over-Readhttps://agentprime.io/advisories/CVE-2025-68431/https://agentprime.io/advisories/CVE-2025-68431/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 29 Dec 2025 19:09:54 GMTCVE