[Git][security-tracker-team/security-tracker][master] Add new batch of libheif issues

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
1aa0ee61 by Salvatore Bonaccorso at 2026-10-11T11:43:29+02:00
Add new batch of libheif issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -21800,6 +21800,42 @@ CVE-2026-93402 [mdtls discards the peer-identity verification result]
 	NOTE: https://github.com/rsyslog/rsyslog/pull/7617
 	NOTE: Fixed by: https://github.com/rsyslog/rsyslog/commit/ef9f77d709640ceb3d5e78118081a291f9e373c5
 	NOTE: Fixed by: https://github.com/rsyslog/rsyslog/commit/7847bd5392cb018646afc8f267aedfb5d51df1f9
+CVE-2026-XXXX [GHSA-8p2c-9wv4-rx4p: NULL pointer dereference in `Track_Visual::decode_next_image_sample()` when a sequence chunk references a non-visual sample entry]
+	- libheif 1.23.6-1
+	NOTE: https://github.com/strukturag/libheif/security/advisories/GHSA-8p2c-9wv4-rx4p
+CVE-2026-XXXX [GHSA-fcmw-5764-7rq8: Decompressed `unci` tile data escapes the memory budget in the `cmpC` `image_tile` branch]
+	- libheif 1.23.6-1
+	NOTE: https://github.com/strukturag/libheif/security/advisories/GHSA-fcmw-5764-7rq8
+CVE-2026-XXXX [GHSA-6fqc-p7r8-2g36: CPU amplification: a generically compressed `unci` item is decompressed once per tile]
+	- libheif 1.23.6-1
+	NOTE: https://github.com/strukturag/libheif/security/advisories/GHSA-6fqc-p7r8-2g36
+CVE-2026-XXXX [GHSA-86ch-j429-fpr2: HEVC size limits can be skipped before decoding with the FFmpeg decoder plugin]
+	- libheif 1.23.6-1
+	NOTE: https://github.com/strukturag/libheif/security/advisories/GHSA-86ch-j429-fpr2
+CVE-2026-XXXX [GHSA-vr5j-9r89-725x: CPU amplification in unci decode path surviving GHSA-24wx-9w62-c96w fix]
+	- libheif <unfixed>
+	NOTE: https://github.com/strukturag/libheif/security/advisories/GHSA-vr5j-9r89-725x
+CVE-2026-XXXX [GHSA-hqpw-h8p6-22q9: Heap out-of-bounds read in the FFmpeg decoder plugin: input passed to av_parser_parse2() without padding]
+	- libheif 1.23.6-1
+	NOTE: https://github.com/strukturag/libheif/security/advisories/GHSA-hqpw-h8p6-22q9
+CVE-2026-XXXX [GHSA-q7mw-2fmm-5q94: Out-of-bounds read in libsharpyuv through sample values above the image's bit depth]
+	- libheif 1.23.6-1
+	NOTE: https://github.com/strukturag/libheif/security/advisories/GHSA-q7mw-2fmm-5q94
+CVE-2026-XXXX [GHSA-v5rj-g4wv-j5w3: Uncompressed codec returns chroma samples above the declared bit depth in mixed interleave mode]
+	- libheif 1.23.6-1
+	NOTE: https://github.com/strukturag/libheif/security/advisories/GHSA-v5rj-g4wv-j5w3
+CVE-2026-XXXX [GHSA-3gwx-cjv4-jr74: Reachable assertion when decoding a grid image with an alpha plane of more than 16 bits]
+	- libheif 1.23.6-1
+	NOTE: https://github.com/strukturag/libheif/security/advisories/GHSA-3gwx-cjv4-jr74
+CVE-2026-XXXX [GHSA-hvwh-xpj6-ph5x: Error message used after free in heif-enc input loaders]
+	- libheif 1.23.6-1
+	NOTE: https://github.com/strukturag/libheif/security/advisories/GHSA-hvwh-xpj6-ph5x
+CVE-2026-XXXX [GHSA-vv35-6hxg-95x8: Decoded image can have another bit depth than the image handle reports]
+	- libheif 1.23.6-1
+	NOTE: https://github.com/strukturag/libheif/security/advisories/GHSA-vv35-6hxg-95x8
+CVE-2026-XXXX [GHSA-h4h8-qgvc-m7r2: OpenJPEG decoder: tile and component counts of a JPEG 2000 codestream cause allocations of several gigabytes regardless of the security limits]
+	- libheif 1.23.6-1
+	NOTE: https://github.com/strukturag/libheif/security/advisories/GHSA-h4h8-qgvc-m7r2
 CVE-2026-XXXX [GHSA-v8qw-hwjv-44hw: AV1/libaom path allows allocation before libheif rejects mismatched coded dimensions]
 	- libheif 1.23.6-1
 	[trixie] - libheif <no-dsa> (Minor issue)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/1aa0ee6163faa98cdff1fa1bb6442e2c04207a02

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/1aa0ee6163faa98cdff1fa1bb6442e2c04207a02
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261011/a11611df/attachment-0001.htm>