Libheif
Vendor:
First CVE: Apr 23, 2019 · Active for 7 years
22
Total CVEs
More Total CVEs than 94% of tracked products
3.7
Avg CVEs / Year
Higher CVE frequency than 83% of tracked products
7.8
Avg CVSS
Higher Avg CVSS than 63% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Libheif over time
Volume of CVEsAvg CVSS Base Score
First CVE
Apr 23, 2019
7 years ago
Most Recent CVE
Jun 19, 2026
37 days ago
CVE Severity & Scoring
Libheif22 CVEs
27%
73%
All CVEs352,713 CVEs
45%
40%
11%
MediumHigh
Attack Vector
Local2 (9.1%)
Network20 (90.9%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low22 (100.0%)
High0 (0.0%)
Unknown0 (0.0%)
User Interaction
None4 (18.2%)
Unknown0 (0.0%)
Required18 (81.8%)
Privileges Required
Low0 (0.0%)
High0 (0.0%)
None22 (100.0%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (22 CVEs).
22 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2026-32740HIGH libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.21.2 and prior contain a heap-buffer-overflow (write) vulnerability in the grid tile compositing, allowing an | May 19, 2026 | 8.8 | 37 | NO | NO |
CVE-2026-41071HIGH libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, a crafted HEIF sequence file where the saiz box declares more samples than actually exist | May 22, 2026 | 8.1 | 31 | NO | NO |
CVE-2026-49271MEDIUM libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.1, the uncompressed HEIF decoder validates explicit icef compressed-unit offsets using unit_offset | Jun 19, 2026 | 6.5 | 28 | NO | NO |
CVE-2026-32739MEDIUM libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and below, a crafted 800-byte HEIF sequence file causes an infinite loop in Box_stts::get_sample_dura | May 19, 2026 | 6.5 | 28 | NO | NO |
CVE-2026-32738MEDIUM libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and below, a crafted 792-byte HEIF sequence file with samples_per_chunk=0 in the stsc box causes an u | May 19, 2026 | 6.5 | 28 | NO | NO |
CVE-2020-19499HIGH An issue was discovered in heif::Box_iref::get_references in libheif 1.4.0, allows attackers to cause a Denial of Service or possibly other unspecified impact due to an invalid mem | Jul 21, 2021 | 8.8 | 28 | NO | NO |
CVE-2026-41069MEDIUM libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, a malformed HEIF sequence file can trigger an out-of-bounds read in core sequence parsing | May 22, 2026 | 6.5 | 27 | NO | NO |
CVE-2020-19498HIGH Floating point exception in function Fraction in libheif 1.4.0, allows attackers to cause a Denial of Service or possibly other unspecified impacts. | Jul 21, 2021 | 8.8 | 27 | NO | NO |
CVE-2019-11471HIGH libheif 1.4.0 has a use-after-free in heif::HeifContext::Image::set_alpha_channel in heif_context.h because heif_context.cc mishandles references to non-existing alpha images. | Apr 23, 2019 | 8.8 | 27 | NO | NO |
CVE-2025-68431HIGH libheif is an HEIF and AVIF file format decoder and encoder. Prior to version 1.21.0, a crafted HEIF that exercises the overlay image item path triggers a heap buffer over-read in | Dec 29, 2025 | 7.1 | 25 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (22 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (22 CVEs).
Media Mentions
Signals from CVEs in this product scope (22 CVEs).
Top CNAs Publishing CVEs For Libheif
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 1.6.2 | 1 | 8.1 | 1.3% | 0 | 0 |
| 1.4.0 | 3 | 8.8 | 1.5% | 0 | 0 |
| 1.19.7 | 1 | 6.2 | 0.2% | 0 | 0 |
| 1.17.6 | 1 | 8.1 | 0.7% | 0 | 0 |
| 1.17.5 | 4 | 8.8 | 0.8% | 0 | 0 |
| 1.15.1 | 1 | 6.5 | 0.9% | 0 | 0 |
| 1.14.2 | 1 | 7.8 | 0.3% | 0 | 0 |