strukturag vulnerabilities

CVEs per yearBy the year they were published

1. 20221
2. 20251
3. 202642

Newest CVEs

• CVE-2026-120208

  libheif 1.18.0 before 1.23.3 Heap Buffer Overflow via unci Mixed-Interleave Decoder

  strukturag · libheif

  High7.7
• CVE-2026-84450

  libheif: `clap` + oversized `ispe` aborts on an assert in `Fraction::Fraction` (incomplete fix for CVE-2026-62289)

  strukturag · libheif

  Medium4.3
• CVE-2026-84449

  libheif hOp_RGB24_32_to_YCbCr Memory Access Error / SEGV

  strukturag · libheif

  Low3.7
• CVE-2026-84451

  libheif: Incomplete fix for CVE-2026-62292 leaves libheif vulnerable to an out-of-bounds read

  strukturag · libheif

  Medium6.5
• CVE-2026-84447

  libheif: Derived-image indirect reference chains and tiled offsets bypass decode caching and MemoryHandle limits, causing CPU/memory amplification DoS

  strukturag · libheif

  High7.5
• CVE-2026-84384

  libheif: brotli/zlib decompression paths lack output-size limits, allowing decompression-bomb OOM/DoS

  strukturag · libheif

  High7.5
• CVE-2026-84444

  libheif uncompressed tiled image encoding allows out-of-bounds write

  strukturag · libheif

  High7.4
• CVE-2026-84383

  libheif: Heap buffer overflow in `scale_nearest_neighbor()` via duplicate Alpha planes from nested `iden`/`auxl` items

  strukturag · libheif

  Critical9.8
• CVE-2026-84446

  libheif: Sequence decode timing-table initialization allows non-terminating loops and unbounded memory, bypassing max_sequence_frames

  strukturag · libheif

  High7.5
• CVE-2026-84448

  libheif: Heap out-of-bounds read in libheif inline-mask region API (heif_region_item_add_region_inline_mask_data / heif_region_get_mask_image)

  strukturag · libheif

  Medium4.0