Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2023-49464: Debian libheif 1.17.5 may crash on some images

CVE-2023-49464 · published 2 years ago

Summary

The libheif library used by Debian to handle HEIF photos can cause a program to stop unexpectedly when it processes certain image settings. Any software on Debian that relies on this library to open or edit HEIF files could be affected. Install the latest libheif update from Debian or apply the vendor’s patch to stop the crashes.

What to do

Update debian libheif to version 1.17.6-1.

Affected software

Ecosystem	Vendor	Product	Affected versions
Debian:13	debian	libheif	< 1.17.6-1 Fix: upgrade to 1.17.6-1
Debian:14	debian	libheif	< 1.17.6-1 Fix: upgrade to 1.17.6-1

Original advisory text

libheif v1.17.5 was discovered to contain a segmentation violation via the function UncompressedImageCodec::get_luma_bits_per_pixel_from_configuration_unci.

References

https://security-tracker.debian.org/tracker/CVE-2023-49464 Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/49xxx/CVE-2023-49464... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-49464 Vendor Advisory
https://github.com/strukturag/libheif/issues/1044 Third Party Advisory

Severity

8.8 High

Exploitation

<1% chance of attack within 30 days

Timeline

Published7 Dec 2023

Updated4 Nov 2026

First seen15 Sep 2026

Sources

DEBIAN-CVE-2023-49464 · OSV

CVE-2023-49464 · NVD

CVE-2023-49464 · OSV

Track software like this

Free during beta