https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 13:04:15 +0000 https://cve.radiocsirt.org/vuln/bell-cve-2026-62289 <p><strong>Affected:</strong> Alpaquita:stream: libheif</p> <p><strong>Affected:</strong> Alpaquita:stream: libheif</p> https://cve.radiocsirt.org/vuln/bell-cve-2026-62289 https://cve.radiocsirt.org/vuln/euvd-2026-356437 EUVD-2026-356437 https://cve.radiocsirt.org/vuln/euvd-2026-356437 https://cve.radiocsirt.org/vuln/fkie_cve-2026-62289 <p>libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF or AVIF file containing a clean aperture box can reduce an image dimension to zero and crash or corrupt tiling results when heif_image_handle_get_image_tiling(handle, 1, &amp;tiling) is called. ImageItem::get_heif_image_tiling() returns already transformed dimensions, and process_image_transformations_on_tiling() applies the clean aperture transformation again. The second application passes zero to Box_clap::left_rounded(0), where image_width minus one underflows and constructs Fraction(0xFFFFFFFF, 2). Debug builds reach an assertion and abort, while release builds can return a corrupt crop and zero-width tiling result. The affected implementation spans libheif/image-items/image_item.cc, libheif/context.cc, and libheif/box.cc. This issue is fixed in version 1.23.1.</p> <p>libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF or AVIF file containing a clean aperture box can reduce an image dimension to zero and crash or corrupt tiling results when heif_image_handle_get_image_tiling(handle, 1, &amp;tiling) is called. ImageItem::get_heif_image_tiling() returns already transformed dimensions, and process_image_transformations_on_tiling() applies the clean aperture transformation again. The second application passes zero to Box_clap::left_rounded(0), where image_width minus one underflows and constructs Fraction(0xFFFFFFFF, 2). Debug builds reach an assertion and abort, while release builds can return a corrupt crop and zero-width tiling result. The affected implementation spans libheif/image-items/image_item.cc, libheif/context.cc, and libheif/box.cc. This issue is fixed in version 1.23.1.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-62289 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11416-1 <p>gdk-pixbuf-loader-libheif-1.23.1-1.1 on GA media</p> <p>gdk-pixbuf-loader-libheif-1.23.1-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:11416-1 https://cve.radiocsirt.org/vuln/suse-su-2026:23320-1 <p>Security update for libheif</p> <p>Security update for libheif</p> https://cve.radiocsirt.org/vuln/suse-su-2026:23320-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-62289 <p><strong>Affected:</strong> Ubuntu:Pro:18.04:LTS: libheif, Ubuntu:Pro:20.04:LTS: libheif, Ubuntu:Pro:22.04:LTS: libheif, Ubuntu:24.04:LTS: libheif, Ubuntu:26.04:LTS: libheif</p> <p>libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF or AVIF file containing a clean aperture box can reduce an image dimension to zero and crash or corrupt tiling results when heif_image_handle_get_image_tiling(handle, 1, &amp;tiling) is called. ImageItem::get_heif_image_tiling() returns already transformed dimensions, and process_image_transformations_on_tiling() applies the clean aperture transformation again. The second application passes zero to Box_clap::left_rounded(0), where image_width minus one underflows and constructs Fraction(0xFFFFFFFF, 2). Debug builds reach an assertion and abort, while release builds can return a corrupt crop and zero-width tiling result. The affected implementation spans libheif/image-items/image_item.cc, libheif/context.cc, and libheif/box.cc. This issue is fixed in version 1.23.1.</p> <p><strong>Affected:</strong> Ubuntu:Pro:18.04:LTS: libheif, Ubuntu:Pro:20.04:LTS: libheif, Ubuntu:Pro:22.04:LTS: libheif, Ubuntu:24.04:LTS: libheif, Ubuntu:26.04:LTS: libheif</p> <p>libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF or AVIF file containing a clean aperture box can reduce an image dimension to zero and crash or corrupt tiling results when heif_image_handle_get_image_tiling(handle, 1, &amp;tiling) is called. ImageItem::get_heif_image_tiling() returns already transformed dimensions, and process_image_transformations_on_tiling() applies the clean aperture transformation again. The second application passes zero to Box_clap::left_rounded(0), where image_width minus one underflows and constructs Fraction(0xFFFFFFFF, 2). Debug builds reach an assertion and abort, while release builds can return a corrupt crop and zero-width tiling result. The affected implementation spans libheif/image-items/image_item.cc, libheif/context.cc, and libheif/box.cc. This issue is fixed in version 1.23.1.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-62289