https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T11:40:24.910887+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bell-cve-2026-47247 BELL-CVE-2026-47247 2026-10-03T11:40:25.002235+00:00

Affected: Alpaquita:stream: libheif

 https://cve.radiocsirt.org/vuln/euvd-2026-339379 EUVD-2026-339379 2026-10-03T11:40:25.002304+00:00 EUVD-2026-339379 https://cve.radiocsirt.org/vuln/fkie_cve-2026-47247 fkie_cve-2026-47247 2026-10-03T11:40:25.002331+00:00

libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, two bugs in libheif chain to leak process heap memory as visible pixel values in decoded grid images. An attacker who uploads a crafted AVIF/HEIC file to any server-side image processor (WordPress, Sharp/libvips, ImageMagick, etc.) can recover heap data - including library function pointers sufficient to defeat ASLR, or any other secret - from the publicly-downloadable transcoded JPEG/PNG/WebP output. Local attack vectors are also possible. Version 1.22.0 fixes the issue.

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10878-1 openSUSE-SU-2026:10878-1 — gdk-pixbuf-loader-libheif-1.22.2-1.1 on GA media 2026-10-03T11:40:25.002374+00:00

gdk-pixbuf-loader-libheif-1.22.2-1.1 on GA media

 https://cve.radiocsirt.org/vuln/suse-su-2026:22153-1 SUSE-SU-2026:22153-1 — Security update for libheif 2026-10-03T11:40:25.002417+00:00

Security update for libheif

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-47247 UBUNTU-CVE-2026-47247 2026-10-03T11:40:25.002468+00:00

Affected: Ubuntu:Pro:20.04:LTS: libheif, Ubuntu:Pro:22.04:LTS: libheif, Ubuntu:24.04:LTS: libheif, Ubuntu:25.10: libheif, Ubuntu:26.04:LTS: libheif

libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, two bugs in libheif chain to leak process heap memory as visible pixel values in decoded grid images. An attacker who uploads a crafted AVIF/HEIC file to any server-side image processor (WordPress, Sharp/libvips, ImageMagick, etc.) can recover heap data - including library function pointers sufficient to defeat ASLR, or any other secret - from the publicly-downloadable transcoded JPEG/PNG/WebP output. Local attack vectors are also possible. Version 1.22.0 fixes the issue.