Dear maintainer,

The following vulnerability was published for libheif. CVEs arel not
allocated yet.

GHSA-vg7w-rp49-4fc2[1] — High, 8.7 — max_items not enforced for iinf
child boxes.
GHSA-xrp2-63fq-jm8q[2] — High, 8.7 — unbounded iref list and unbounded
recursion.
GHSA-prgh-72vc-3xmc[3] — High, 8.7 — lock-order inversion deadlocks
parallel grid tile decoding.
GHSA-4rv4-953r-p24q[4] — Moderate, 6.9 — leak and uncaught exception
in the raw sequence sample API.
GHSA-fqpw-fj22-78w4[5] — Moderate, 6.3 — heap over-read in encoder
plugins on mismatched bit depths.
GHSA-rhgw-q5g8-xjh2[6] — Moderate, 4.3 — heap over-read in the
WebCodecs decoder.

For further information see:

[1] https://github.com/strukturag/libheif/security/advisories/GHSA-vg7w-rp49-4fc2
[2] https://github.com/strukturag/libheif/security/advisories/GHSA-xrp2-63fq-jm8q
[3] https://github.com/strukturag/libheif/security/advisories/GHSA-prgh-72vc-3xmc
[4] https://github.com/strukturag/libheif/security/advisories/GHSA-4rv4-953r-p24q
[5] https://github.com/strukturag/libheif/security/advisories/GHSA-fqpw-fj22-78w4
[6] https://github.com/strukturag/libheif/security/advisories/GHSA-rhgw-q5g8-xjh2

Regards,
Aron

We believe that the bug you reported is fixed in the latest version of
libheif, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1148137@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Joachim Bauch <fancycode@debian.org> (supplier of updated libheif package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Thu, 17 Sep 2026 21:27:18 +0200
Source: libheif
Built-For-Profiles: noudeb
Architecture: source
Version: 1.23.4-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Multimedia Maintainers <debian-multimedia@lists.debian.org>
Changed-By: Joachim Bauch <fancycode@debian.org>
Closes: 1148137
Changes:
 libheif (1.23.4-1) unstable; urgency=medium
 .
   * New upstream version 1.23.4
   * Various security fixes (Closes: #1148137):
     - Fixes unbound parsing of iinf child boxes. See upstream commits
       2ebb06f, 19fd108, eb339b7 and 92b79c6 (GHSA-vg7w-rp49-4fc2).
     - Fixes unbounded recursion when checking reference cycles.
       See upstream commits b1e4d72 and 7538a4f (GHSA-xrp2-63fq-jm8q).
     - Fixes decoder deadlock through lock-order inversion. See upstream
       commit f8beb40 (GHSA-prgh-72vc-3xmc).
     - Fixes heap out-of-bounds read when encoding images with different
       luma and chroma bit depths. See upstream commit 51360e1
       (GHSA-fqpw-fj22-78w4).
     - Fixes memory leak in heif_track_get_next_raw_sequence_sample.
       See upstream commit 3d9c246 (GHSA-4rv4-953r-p24q).
     - Fixes heap out-of-bounds read in the WebCodecs decoder plugin.
       See upstream commits fb8d945 and 604d837 (GHSA-rhgw-q5g8-xjh2).
Checksums-Sha1:
 e40e673f19806fd490ce21ec6bf32fc1aa5d7b42 3844 libheif_1.23.4-1.dsc
 f8ab778f373973dcada7c77236d711e1310cc26a 2217221 libheif_1.23.4.orig.tar.gz
 c2264734e5ea7149a6a3c75c569e486878d6fabe 15244 libheif_1.23.4-1.debian.tar.xz
 08c6d17f9dd6b1dee41357bde3e8ff68d8630d80 16104 libheif_1.23.4-1_source.buildinfo
Checksums-Sha256:
 042456f22e06a4cbc878b59de2ff803d3edf636ee4b12506885e3b6bdcf586c6 3844 libheif_1.23.4-1.dsc
 d0c02b4b0e978f34a1974b6f3eea7975a537bf7a9195ffeea38e7242ff316fdd 2217221 libheif_1.23.4.orig.tar.gz
 bafcccab0e63fa72461c47c95e0235b16e9d091b64535c44d7c2d2e9864a25ca 15244 libheif_1.23.4-1.debian.tar.xz
 d77f09f3e9878e62af44a81a0ab0666de411e9c97aed39c5cfdd9cad9c2ea4a5 16104 libheif_1.23.4-1_source.buildinfo
Files:
 9c26f303cea0f76e884528329723b047 3844 libs - libheif_1.23.4-1.dsc
 9cd6d40e19496a839dc9a7ba0b750f76 2217221 libs - libheif_1.23.4.orig.tar.gz
 90dab9bd4d7efcb2a1a7550b3887a3d1 15244 libs - libheif_1.23.4-1.debian.tar.xz
 a81bf698cef82d0b284d33945dddea57 16104 libs - libheif_1.23.4-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEvj2K8Ga27IB5Zn/Xd8HSLVPhXwIFAmqsPzwACgkQd8HSLVPh
XwJ8DQ/9FUtlQi3HLJzHHujXqFjV7CGvJTjR60mWk+UIlVQmJ6ewVVk3ASLfTUOx
NhzaGLDCm0jq+JLdVwE+BGC99waPeYrX2+UteGzWdh9CsJgCyHCacbkiv7FbdE+/
ZN0EW9+2QzBUZqsTPZyR77GKHkHcoGkVG5BuaoIUzeOAOctLbBSfeopTmvx+m20k
AZ6Ee25uA+Z3pxP5wq4RmJEj0andaL9KR/9XpiixLX/MBCJ0wDXTVxuGKoOG6cwc
I1/txS1tG9TUISW89yh6B/AHLvMwpUBAerR2vlPYCyjytamIIvwQ/kG9u8ac9XwI
Rxx/zi5blFj2ZxnYAjIFZTI4vFjAz7A5oWaskgtyYugP/H6Kkf6s0O5oQ/SAM0F3
c7pWRANrFsD1gFln7pKjLYSFzZugsAARdfj1MQjIAC8bVOz5kpQxs5ViFrwSzxoq
YiMhx/VBrSt5jPDSE/olx8kQTBDbz7wIif/Ov4pXchcBVXOTTHrDQwTXMYh+xWHv
nkq7Bcan2UuxaZLGuoefrj1A1C38Hu+LKTKS7vgWFa2PJSgiuqbMyOQiTHQY4xx1
Gtq3bdkFwPXzmC8E5SQ+ZwV2DW1PFGPNS0haZTd5ZS0wjCyej4+hIIT8gqgYCHgq
mmUXCrwLsbomC2vd9yMm11P8J4ExJfC83I/CZL+HnEwVFXX8myw=
=1cvK
-----END PGP SIGNATURE-----