libheif v1.22.0 security bulletin: Fix for 18 CVEs including heap overflow and DoS

Vulnerability Overview This version (v1.22.0) fixes multiple security vulnerabilities, primarily involving integer overflows, null pointer dereferences, and uninitialized memory issues. Specifically: CVE-2026-32738: Heap buffer overflow triggered by in . CVE-2026-32739: Infinite loop DoS triggered by . CVE-2026-32740: Heap buffer overflow triggered by . CVE-2026-32741: Heap buffer overflow triggered by . CVE-2026-32814: Uninitialized heap memory leak triggered by . CVE-2026-32882: Heap buffer overflow triggered by . CVE-2026-41069: Out-of-bounds read triggered by . CVE-2026-41071: Heap buffer overflow triggered by . CVE-2026-47178: Out-of-bounds write triggered by . CVE-2026-47247: Information leak triggered by . CVE-2026-47251: Integer overflow bypass triggered by . CVE-2026-47254: Heap buffer overflow triggered by . CVE-2026-47709: Null pointer dereference triggered by . CVE-2026-47714: Integer overflow triggered by . CVE-2026-48029: Heap buffer overflow triggered by . CVE-2026-49515: Integer overflow triggered by . CVE-2026-49672: Byte count error triggered by . CVE-2026-49720: Out-of-bounds read triggered by . CVE-2026-49846: Heap buffer overflow triggered by . Impact Scope These vulnerabilities may affect users of the libheif library who process image files, particularly those handling HEIF, JPEG, TIFF, and other formats. Attackers can trigger these vulnerabilities by constructing malicious image files, leading to program crashes, information leaks, or arbitrary code execution. Remediation Update to the latest version: Users are advised to update to v1.22.0 or later as soon as possible to fix all the aforementioned vulnerabilities. Code review: Developers should carefully review the code to ensure no similar vulnerabilities exist. Input validation: Strictly validate all input data to prevent malicious inputs from triggering vulnerabilities. Use secure libraries: Consider using third-party libraries that have undergone security audits to process image files. POC Code No specific POC code is provided on the page.

Goal Reached Thanks to every supporter — we hit 100%!

libheif v1.22.0 security bulletin: Fix for 18 CVEs including heap overflow and DoS

More from this source