Libheif vulnerabilities

3 known vulnerabilities in Libheif from Struktur. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  libheif: NULL Pointer Dereference

  CVE-2025-43967Apr 21, 2025Struktur

  libheif before 1.19.6 has a NULL pointer dereference in ImageItem_Grid::get_decoder in image-items/grid.cc because a grid image can reference a nonexistent image item.

• 8.1 High severity

  libheif: Out-of-bounds Read

  CVE-2024-41311Oct 15, 2024Struktur

  In Libheif 1.17.6, insufficient checks in ImageOverlay::parse() decoding a heif file containing an overlay image with forged offsets can lead to an out-of-bounds read and write.

• 7.8 High severity

  libheif: Buffer Copy without Checking Size of Input

  CVE-2023-0996Feb 24, 2023Struktur

  There is a vulnerability in the strided image data parsing code in the emscripten wrapper for libheif. An attacker could exploit this through a crafted image file to cause a buffer overflow in linear memory during a memcpy call.