{"id":"CVE-2026-62291","aliases":["BELL-CVE-2026-62291","DEBIAN-CVE-2026-62291","EUVD-2026-62190","GHSA-xpw3-9rhw-482x","SUSE-SU-2026:23320-1","SUSE-SU-2026:3597-1","UBUNTU-CVE-2026-62291","USN-8683-1","USN-8774-1","openSUSE-SU-2026:11416-1","openSUSE-SU-2026:21644-1"],"status":"published","title":"libheif: Heap out of bounds write in libheif uncompressed encoder when writing images with mismatched auxiliary alpha dimensions","description":"libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted image sequence with a 2x2 primary plane and a 256x256 auxiliary alpha plane can cause attacker-controlled heap corruption during a normal decode and re-encode workflow. Track_Visual::decode_next_image_sample() calls transfer_channel_from_image_as() without checking that the auxiliary alpha dimensions match the main frame. The resulting inconsistent image reaches heif_track_decode_next_image() and then heif_context_encode_image(). In unc_encoder::encode(), unc_encoder_component_interleave::encode_tile() sizes its buffer with compute_tile_data_size_bytes() using the primary dimensions but copies each component using its actual plane dimensions. The oversized alpha plane is therefore copied beyond the allocation, causing an out-of-bounds write; the inverse size mismatch can also produce an out-of-bounds read. This issue is fixed in version 1.23.1.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00187,"percentile":0.08422,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125","CWE-787"],"published":"2026-08-01T00:00:00Z","modified":"2026-10-28T10:55:03Z","fixes":[{"ecosystem":"Alpaquita:stream","package":"libheif","fixed_in":["1.23.4-r0"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libheif","fixed_in":["1.23.1-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"libheif","fixed_in":["1.17.6-1ubuntu4.8"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"libheif","fixed_in":["1.21.2-3ubuntu0.5"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpaquita:stream","package":"libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.20.2-r2"},{"fixed":"1.23.4-r0"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.1-1"}]}],"versions":["1.19.8-1","1.20.1-1","1.20.2-1","1.20.2-2","1.21.2-1","1.21.2-2","1.21.2-3","1.21.2-4"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.1-160000.1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.1-160000.1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP7","package":"libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.1-150700.3.18.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.1-150700.3.18.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.6-1ubuntu4.8"}]}],"versions":["1.16.2-2ubuntu1","1.17.1-1ubuntu2","1.17.1-1ubuntu3","1.17.4-1ubuntu1","1.17.6-1ubuntu1","1.17.6-1ubuntu2","1.17.6-1ubuntu3","1.17.6-1ubuntu4","1.17.6-1ubuntu4.1","1.17.6-1ubuntu4.2","1.17.6-1ubuntu4.3","1.17.6-1ubuntu4.4","1.17.6-1ubuntu4.5","1.17.6-1ubuntu4.6","1.17.6-1ubuntu4.7"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.2-3ubuntu0.5"}]}],"versions":["1.20.2-1","1.20.2-2","1.20.2-2build1","1.20.2-2build2","1.20.2-2ubuntu1","1.21.2-1","1.21.2-3","1.21.2-3ubuntu0.1","1.21.2-3ubuntu0.2","1.21.2-3ubuntu0.3","1.21.2-3ubuntu0.4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-2ubuntu0.1~esm4"}]}],"versions":["1.1.0-2","1.1.0-2ubuntu0.1~esm1","1.1.0-2ubuntu0.1~esm2","1.1.0-2ubuntu0.1~esm3"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-1ubuntu0.1~esm4"}]}],"versions":["1.5.0-1build1","1.5.1-1","1.5.1-1build1","1.6.0-1","1.6.1-1","1.6.1-1build1","1.6.1-1ubuntu0.1~esm1","1.6.1-1ubuntu0.1~esm2","1.6.1-1ubuntu0.1~esm3"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.0-2ubuntu0.1~esm4"}]}],"versions":["1.11.0-1","1.12.0-2build1","1.12.0-2ubuntu0.1~esm1","1.12.0-2ubuntu0.1~esm2","1.12.0-2ubuntu0.1~esm3"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.6-1ubuntu4.8"}]}],"versions":["1.16.2-2ubuntu1","1.17.1-1ubuntu2","1.17.1-1ubuntu3","1.17.4-1ubuntu1","1.17.6-1ubuntu1","1.17.6-1ubuntu2","1.17.6-1ubuntu3","1.17.6-1ubuntu4","1.17.6-1ubuntu4.1","1.17.6-1ubuntu4.2","1.17.6-1ubuntu4.3","1.17.6-1ubuntu4.4","1.17.6-1ubuntu4.5","1.17.6-1ubuntu4.6","1.17.6-1ubuntu4.7"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.2-3ubuntu0.5"}]}],"versions":["1.20.2-1","1.20.2-2","1.20.2-2build1","1.20.2-2build2","1.20.2-2ubuntu1","1.21.2-1","1.21.2-3","1.21.2-3ubuntu0.1","1.21.2-3ubuntu0.2","1.21.2-3ubuntu0.3","1.21.2-3ubuntu0.4"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.1-1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.1-160000.1.1"}]}],"bundled":4}],"products":[{"vendor":"strukturag","product":"libheif"}],"references":[{"url":"https://github.com/strukturag/libheif/security/advisories/GHSA-xpw3-9rhw-482x","tags":["x_refsource_CONFIRM","exploit","advisory","report"]},{"url":"https://github.com/strukturag/libheif/commit/ac5521ad50399885de96bb6a0733a5d2442740f9","tags":["x_refsource_MISC","fix","report"]},{"url":"https://github.com/strukturag/libheif/releases/tag/v1.23.1","tags":["x_refsource_MISC","web","report"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-62291","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/62xxx/CVE-2026-62291.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62291","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-62291","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623320-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1273079","tags":["report"]},{"url":"https://bugzilla.suse.com/1273080","tags":["report"]},{"url":"https://bugzilla.suse.com/1273081","tags":["report"]},{"url":"https://bugzilla.suse.com/1273082","tags":["report"]},{"url":"https://bugzilla.suse.com/1273083","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-62289","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-62291","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-62292","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-62377","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263597-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-62291","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-62291","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8683-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8774-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-62289","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-62377","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-62291","title":"libheif: Heap out of bounds write in libheif uncompressed encoder when writing images with mismatched auxiliary alpha dimensions","description":"libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted image sequence with a 2x2 primary plane and a 256x256 auxiliary alpha plane can cause attacker-controlled heap corruption during a normal decode and re-encode workflow. Track_Visual::decode_next_image_sample() calls transfer_channel_from_image_as() without checking that the auxiliary alpha dimensions match the main frame. The resulting inconsistent image reaches heif_track_decode_next_image() and then heif_context_encode_image(). In unc_encoder::encode(), unc_encoder_component_interleave::encode_tile() sizes its buffer with compute_tile_data_size_bytes() using the primary dimensions but copies each component using its actual plane dimensions. The oversized alpha plane is therefore copied beyond the allocation, causing an out-of-bounds write; the inverse size mismatch can also produce an out-of-bounds read. This issue is fixed in version 1.23.1.","status":"published","published":"2026-08-18T21:21:32.182Z","modified":"2026-08-21T19:11:12.114Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-125","CWE-787"],"updated_at":"2026-11-02T14:20:14.665567Z"}],"euvd":[{"id":"EUVD-2026-62190","description":"libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted image sequence with a 2x2 primary plane and a 256x256 auxiliary alpha plane can cause attacker-controlled heap corruption during a normal decode and re-encode workflow. Track_Visual::decode_next_image_sample() calls transfer_channel_from_image_as() without checking that the auxiliary alpha dimensions match the main frame. The resulting inconsistent image reaches heif_track_decode_next_image() and then heif_context_encode_image(). In unc_encoder::encode(), unc_encoder_component_interleave::encode_tile() sizes its buffer with compute_tile_data_size_bytes() using the primary dimensions but copies each component using its actual plane dimensions. The oversized alpha plane is therefore copied beyond the allocation, causing an out-of-bounds write; the inverse size mismatch can also produce an out-of-bounds read. This issue is fixed in version 1.23.1.","status":"published","published":"2026-08-18T21:21:32Z","modified":"2026-08-21T19:11:12Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T18:01:37.198267Z"}],"nvd":[{"id":"CVE-2026-62291","description":"libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted image sequence with a 2x2 primary plane and a 256x256 auxiliary alpha plane can cause attacker-controlled heap corruption during a normal decode and re-encode workflow. Track_Visual::decode_next_image_sample() calls transfer_channel_from_image_as() without checking that the auxiliary alpha dimensions match the main frame. The resulting inconsistent image reaches heif_track_decode_next_image() and then heif_context_encode_image(). In unc_encoder::encode(), unc_encoder_component_interleave::encode_tile() sizes its buffer with compute_tile_data_size_bytes() using the primary dimensions but copies each component using its actual plane dimensions. The oversized alpha plane is therefore copied beyond the allocation, causing an out-of-bounds write; the inverse size mismatch can also produce an out-of-bounds read. This issue is fixed in version 1.23.1.","status":"published","published":"2026-08-18T22:17:02.877Z","modified":"2026-10-22T16:09:59.56Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-125","CWE-787"],"updated_at":"2026-11-02T14:12:39.620837Z"}],"osv":[{"id":"BELL-CVE-2026-62291","status":"published","published":"2026-08-21T06:06:41.657772Z","modified":"2026-10-02T07:15:04.075982234Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:28:24.959902Z"},{"id":"CVE-2026-62291","title":"libheif: Heap out of bounds write in libheif uncompressed encoder when writing images with mismatched auxiliary alpha dimensions","description":"libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted image sequence with a 2x2 primary plane and a 256x256 auxiliary alpha plane can cause attacker-controlled heap corruption during a normal decode and re-encode workflow. Track_Visual::decode_next_image_sample() calls transfer_channel_from_image_as() without checking that the auxiliary alpha dimensions match the main frame. The resulting inconsistent image reaches heif_track_decode_next_image() and then heif_context_encode_image(). In unc_encoder::encode(), unc_encoder_component_interleave::encode_tile() sizes its buffer with compute_tile_data_size_bytes() using the primary dimensions but copies each component using its actual plane dimensions. The oversized alpha plane is therefore copied beyond the allocation, causing an out-of-bounds write; the inverse size mismatch can also produce an out-of-bounds read. This issue is fixed in version 1.23.1.","status":"published","published":"2026-08-18T21:21:32.182Z","modified":"2026-10-28T10:55:03.974118206Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-125","CWE-787"],"updated_at":"2026-11-02T15:45:13.306117Z"},{"id":"DEBIAN-CVE-2026-62291","description":"libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted image sequence with a 2x2 primary plane and a 256x256 auxiliary alpha plane can cause attacker-controlled heap corruption during a normal decode and re-encode workflow. Track_Visual::decode_next_image_sample() calls transfer_channel_from_image_as() without checking that the auxiliary alpha dimensions match the main frame. The resulting inconsistent image reaches heif_track_decode_next_image() and then heif_context_encode_image(). In unc_encoder::encode(), unc_encoder_component_interleave::encode_tile() sizes its buffer with compute_tile_data_size_bytes() using the primary dimensions but copies each component using its actual plane dimensions. The oversized alpha plane is therefore copied beyond the allocation, causing an out-of-bounds write; the inverse size mismatch can also produce an out-of-bounds read. This issue is fixed in version 1.23.1.","status":"published","published":"2026-08-18T22:17:02.877Z","modified":"2026-10-23T17:47:34.257455736Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:57.932517Z"},{"id":"UBUNTU-CVE-2026-62291","description":"libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted image sequence with a 2x2 primary plane and a 256x256 auxiliary alpha plane can cause attacker-controlled heap corruption during a normal decode and re-encode workflow. Track_Visual::decode_next_image_sample() calls transfer_channel_from_image_as() without checking that the auxiliary alpha dimensions match the main frame. The resulting inconsistent image reaches heif_track_decode_next_image() and then heif_context_encode_image(). In unc_encoder::encode(), unc_encoder_component_interleave::encode_tile() sizes its buffer with compute_tile_data_size_bytes() using the primary dimensions but copies each component using its actual plane dimensions. The oversized alpha plane is therefore copied beyond the allocation, causing an out-of-bounds write; the inverse size mismatch can also produce an out-of-bounds read. This issue is fixed in version 1.23.1.","status":"published","published":"2026-08-20T00:00:00Z","modified":"2026-09-18T23:56:34.212006382Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T16:56:43.630667Z"},{"id":"openSUSE-SU-2026:11416-1","title":"gdk-pixbuf-loader-libheif-1.23.1-1.1 on GA media","description":"These are all security issues fixed in the gdk-pixbuf-loader-libheif-1.23.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-01T00:00:00Z","modified":"2026-08-02T11:45:08.020230581Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:21644-1","title":"Security update for libheif","description":"This update for libheif fixes the following issues:\n\nUpdate to version 1.23.1 (jsc#PED-16355).\n\nSecurity issues fixed:\n\n- CVE-2026-62289: integer underflow in Fraction constructor via double clap transform application (bsc#1273079).\n- CVE-2026-62291: heap out-of-bounds write in the uncompressed encoder when writing images with mismatched auxiliary\n  alpha dimensions (bsc#1273080).\n- CVE-2026-62292: out-of-bounds read in uncompressed unci tile range slicing (bsc#1273081).\n- CVE-2026-62377: reachable assertion in `HeifContext::get_track()` aborts on a valid-but-empty HEIF sequence file\n  (bsc#1273082).\n- Heap out-of-bounds write in the uncompressed encoder for RRGGBB images with interleaved bit-depth `\u003c= 8`\n  (bsc#1273083).\n\nChanges for libheif:\n\n- Version 1.23.1\n  + FFmpeg decoder plugin gains AV1, VVC, JPEG, and JPEG 2000/HTJ2K decoding.\n  + SVT-AV1 encoder: new `tune=iq` and `ms-ssim` tune parameters.\n  + C++ API: added getters/setters for the CLLI and MDCV HDR metadata boxes.\n  + Sequence decoder now scales the alpha auxiliary track to the main image size.\n  + Fixed pixi box writing for multi-channel images.\n  + Corrected the placement of the TAI `clock_type` field into the top 2 bits.\n  + Empty/unset plugin directory is no longer scanned.\n","status":"published","published":"2026-08-25T06:33:48Z","modified":"2026-08-27T18:23:13.590222309Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:23320-1","title":"Security update for libheif","description":"This update for libheif fixes the following issues:\n\nUpdate to version 1.23.1 (jsc#PED-16355).\n\nSecurity issues fixed:\n\n- CVE-2026-62289: integer underflow in Fraction constructor via double clap transform application (bsc#1273079).\n- CVE-2026-62291: heap out-of-bounds write in the uncompressed encoder when writing images with mismatched auxiliary\n  alpha dimensions (bsc#1273080).\n- CVE-2026-62292: out-of-bounds read in uncompressed unci tile range slicing (bsc#1273081).\n- CVE-2026-62377: reachable assertion in `HeifContext::get_track()` aborts on a valid-but-empty HEIF sequence file\n  (bsc#1273082).\n- Heap out-of-bounds write in the uncompressed encoder for RRGGBB images with interleaved bit-depth `\u003c= 8`\n  (bsc#1273083).\n\nChanges for libheif:\n\n- Version 1.23.1\n  + FFmpeg decoder plugin gains AV1, VVC, JPEG, and JPEG 2000/HTJ2K decoding.\n  + SVT-AV1 encoder: new `tune=iq` and `ms-ssim` tune parameters.\n  + C++ API: added getters/setters for the CLLI and MDCV HDR metadata boxes.\n  + Sequence decoder now scales the alpha auxiliary track to the main image size.\n  + Fixed pixi box writing for multi-channel images.\n  + Corrected the placement of the TAI `clock_type` field into the top 2 bits.\n  + Empty/unset plugin directory is no longer scanned.\n","status":"published","published":"2026-08-25T06:32:48Z","modified":"2026-09-10T18:23:10.51923243Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:3597-1","title":"Security update for libheif","description":"This update for libheif fixes the following issues:\n\nUpdate to version 1.23.1 (jsc#PED-16355).\n\nSecurity issues fixed:\n\n- CVE-2026-62289: integer underflow in Fraction constructor via double clap transform application (bsc#1273079).\n- CVE-2026-62291: heap out-of-bounds write in the uncompressed encoder when writing images with mismatched auxiliary\n  alpha dimensions (bsc#1273080).\n- CVE-2026-62292: out-of-bounds read in uncompressed unci tile range slicing (bsc#1273081).\n- CVE-2026-62377: reachable assertion in `HeifContext::get_track()` aborts on a valid-but-empty HEIF sequence file\n  (bsc#1273082).\n- Heap out-of-bounds write in the uncompressed encoder for RRGGBB images with interleaved bit-depth `\u003c= 8`\n  (bsc#1273083).\n\nChanges for libheif:\n\n- Version 1.23.1\n  + FFmpeg decoder plugin gains AV1, VVC, JPEG, and JPEG 2000/HTJ2K decoding.\n  + SVT-AV1 encoder: new `tune=iq` and `ms-ssim` tune parameters.\n  + C++ API: added getters/setters for the CLLI and MDCV HDR metadata boxes.\n  + Sequence decoder now scales the alpha auxiliary track to the main image size.\n  + Fixed pixi box writing for multi-channel images.\n  + Corrected the placement of the TAI `clock_type` field into the top 2 bits.\n  + Empty/unset plugin directory is no longer scanned.\n","status":"published","published":"2026-08-12T11:48:46Z","modified":"2026-08-13T09:30:09.120531898Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"USN-8683-1","title":"libheif vulnerabilities","description":"Feng Ning discovered that libheif incorrectly handled certain image\ntransforms. A remote attacker could possibly use this issue to cause a\ndenial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu\n20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2026-62289)\n\nAli Firas discovered that libheif incorrectly handled certain images. An\nattacker could possibly use this issue to cause a denial of service or\nexecute arbitrary code. This issue only affected Ubuntu 24.04 LTS.\n(CVE-2026-62291)","status":"published","published":"2026-08-26T16:56:18Z","modified":"2026-08-31T17:25:55.503479316Z","updated_at":"2026-11-02T16:58:25.103481Z"},{"id":"USN-8774-1","title":"libheif vulnerabilities","description":"Ali Firas discovered that libheif incorrectly handled certain images. An\nattacker could possibly use this issue to cause a denial of service or\nexecute arbitrary code. (CVE-2026-62291)\n\nDmitrijs Trizna discovered that libheif incorrectly handled certain image\nsequences. An attacker could possibly use this issue to cause a denial of\nservice. (CVE-2026-62377)","status":"published","published":"2026-09-16T16:36:02Z","modified":"2026-09-18T23:56:34.304770073Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}