Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
libheif: Malformed HEIF files can cause denial of service
published 4 months ago
Summary
libheif, a library for handling HEIF and AVIF image files, has a vulnerability that can cause a denial of service on Ubuntu 25.10 and 26.04 LTS. An attacker can exploit this issue by sending a specially crafted file. To fix this issue, you should update your Ubuntu system to the latest version of libheif.
What to do
- Update canonical libheif to version 1.1.0-2ubuntu0.1~esm3.
- Update canonical libheif to version 1.6.1-1ubuntu0.1~esm3.
- Update canonical libheif to version 1.12.0-2ubuntu0.1~esm3.
- Update canonical libheif to version 1.17.6-1ubuntu4.4.
- Update canonical libheif to version 1.20.2-1ubuntu0.4.
- Update canonical libheif to version 1.21.2-3ubuntu0.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:Pro:18.04:LTS | canonical | libheif |
< 1.1.0-2ubuntu0.1~esm3 Fix: upgrade to 1.1.0-2ubuntu0.1~esm3
|
| Ubuntu:Pro:20.04:LTS | canonical | libheif |
< 1.6.1-1ubuntu0.1~esm3 Fix: upgrade to 1.6.1-1ubuntu0.1~esm3
|
| Ubuntu:Pro:22.04:LTS | canonical | libheif |
< 1.12.0-2ubuntu0.1~esm3 Fix: upgrade to 1.12.0-2ubuntu0.1~esm3
|
| Ubuntu:24.04:LTS | canonical | libheif |
< 1.17.6-1ubuntu4.4 Fix: upgrade to 1.17.6-1ubuntu4.4
|
| Ubuntu:25.10 | canonical | libheif |
< 1.20.2-1ubuntu0.4 Fix: upgrade to 1.20.2-1ubuntu0.4
|
| Ubuntu:26.04:LTS | canonical | libheif |
< 1.21.2-3ubuntu0.1 Fix: upgrade to 1.21.2-3ubuntu0.1
|
Original advisory text
libheif vulnerabilities
Elhanan Haenel discovered that libheif incorrectly handled certain
malformed HEIF sequence files. An attacker could possibly use this
issue to cause a denial of service. This issue only affected Ubuntu 25.10
and Ubuntu 26.04 LTS. (CVE-2026-32738)
Elhanan Haenel discovered that libheif incorrectly handled certain
malformed HEIF sequence files, leading to an infinite loop. An attacker
could possibly use this issue to cause libheif to use excessive
resources, resulting in a denial of service. This issue only affected
Ubuntu 25.10 and Ubuntu 26.04 LTS. (CVE-2026-32739)
Elhanan Haenel discovered that libheif incorrectly handled certain
crafted HEIF/AVIF image files. An attacker could possibly use this issue
to cause a denial of service or execute arbitrary code. This issue only
affected Ubuntu 25.10 and Ubuntu 26.04 LTS. (CVE-2026-32740)
It was discovered that libheif incorrectly handled certain crafted HEIF
files containing mask images. An attacker could possibly use this issue to
cause a denial of service or execute arbitrary code. This issue only
affected Ubuntu 24.04 LTS, Ubuntu 25.10, and Ubuntu 26.04 LTS.
(CVE-2026-32741)
It was discovered that libheif incorrectly handled certain crafted
grid-based HEIF/AVIF files. An attacker could possibly use this issue to
obtain sensitive information. This issue only affected Ubuntu 20.04 LTS,
Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 25.10, and Ubuntu 26.04 LTS.
(CVE-2026-32814)
It was discovered that libheif incorrectly handled certain crafted HEIF
files when compositing overlay images. An attacker could possibly use this
issue to cause a denial of service or obtain sensitive information.
(CVE-2026-32882)
It was discovered that libheif incorrectly handled certain crafted
files. An attacker could possibly use this issue to cause a denial of
service. This issue only affected Ubuntu 25.10 and Ubuntu 26.04 LTS.
(CVE-2026-3950)
It was discovered that libheif incorrectly handled certain malformed
HEIF sequence files. An attacker could possibly use this issue to cause a
denial of service. This issue only affected Ubuntu 25.10 and Ubuntu 26.04
LTS. (CVE-2026-41069)
It was discovered that libheif incorrectly handled certain crafted HEIF
sequence files. An attacker could possibly use this issue to cause a denial
of service. This issue only affected Ubuntu 25.10 and Ubuntu 26.04 LTS.
(CVE-2026-41071)
malformed HEIF sequence files. An attacker could possibly use this
issue to cause a denial of service. This issue only affected Ubuntu 25.10
and Ubuntu 26.04 LTS. (CVE-2026-32738)
Elhanan Haenel discovered that libheif incorrectly handled certain
malformed HEIF sequence files, leading to an infinite loop. An attacker
could possibly use this issue to cause libheif to use excessive
resources, resulting in a denial of service. This issue only affected
Ubuntu 25.10 and Ubuntu 26.04 LTS. (CVE-2026-32739)
Elhanan Haenel discovered that libheif incorrectly handled certain
crafted HEIF/AVIF image files. An attacker could possibly use this issue
to cause a denial of service or execute arbitrary code. This issue only
affected Ubuntu 25.10 and Ubuntu 26.04 LTS. (CVE-2026-32740)
It was discovered that libheif incorrectly handled certain crafted HEIF
files containing mask images. An attacker could possibly use this issue to
cause a denial of service or execute arbitrary code. This issue only
affected Ubuntu 24.04 LTS, Ubuntu 25.10, and Ubuntu 26.04 LTS.
(CVE-2026-32741)
It was discovered that libheif incorrectly handled certain crafted
grid-based HEIF/AVIF files. An attacker could possibly use this issue to
obtain sensitive information. This issue only affected Ubuntu 20.04 LTS,
Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 25.10, and Ubuntu 26.04 LTS.
(CVE-2026-32814)
It was discovered that libheif incorrectly handled certain crafted HEIF
files when compositing overlay images. An attacker could possibly use this
issue to cause a denial of service or obtain sensitive information.
(CVE-2026-32882)
It was discovered that libheif incorrectly handled certain crafted
files. An attacker could possibly use this issue to cause a denial of
service. This issue only affected Ubuntu 25.10 and Ubuntu 26.04 LTS.
(CVE-2026-3950)
It was discovered that libheif incorrectly handled certain malformed
HEIF sequence files. An attacker could possibly use this issue to cause a
denial of service. This issue only affected Ubuntu 25.10 and Ubuntu 26.04
LTS. (CVE-2026-41069)
It was discovered that libheif incorrectly handled certain crafted HEIF
sequence files. An attacker could possibly use this issue to cause a denial
of service. This issue only affected Ubuntu 25.10 and Ubuntu 26.04 LTS.
(CVE-2026-41071)
References
- https://ubuntu.com/security/notices/USN-8454-1 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-3950 Third Party Advisory
- https://ubuntu.com/security/CVE-2026-32738 Third Party Advisory
- https://ubuntu.com/security/CVE-2026-32739 Third Party Advisory
- https://ubuntu.com/security/CVE-2026-32740 Third Party Advisory
- https://ubuntu.com/security/CVE-2026-32741 Third Party Advisory
- https://ubuntu.com/security/CVE-2026-32814 Third Party Advisory
- https://ubuntu.com/security/CVE-2026-32882 Third Party Advisory
- https://ubuntu.com/security/CVE-2026-41069 Third Party Advisory
- https://ubuntu.com/security/CVE-2026-41071 Third Party Advisory
Timeline
Published18 Jun 2026
Updated18 Jun 2026
First seen18 Jun 2026
Sources
USN-8454-1 · OSV
Track software like this
Free during beta