Ubuntu libheif Critical Denial of Service Issues USN-8454-1

ubuntu

June 18, 2026

Several security issues were fixed in libheif.

Summary

Several security issues were fixed in libheif.

Software Description:

- libheif: An ISO/IEC 23008-12:2017 HEIF and AVIF file format decoder and encoder

Details:

Elhanan Haenel discovered that libheif incorrectly handled certain

malformed HEIF sequence files. An attacker could possibly use this

issue to cause a denial of service. This issue only affected Ubuntu 25.10

and Ubuntu 26.04 LTS. (CVE-2026-32738)

Elhanan Haenel discovered that libheif incorrectly handled certain

malformed HEIF sequence files, leading to an infinite loop. An attacker

could possibly use this issue to cause libheif to use excessive

resources, resulting in a denial of service. This issue only affected

Ubuntu 25.10 and Ubuntu 26.04 LTS. (CVE-2026-32739)

Elhanan Haenel discovered that libheif incorrectly handled certain

crafted HEIF/AVIF image files. An attacker could possibly use this issue

to cause a denial of service or execute arbitrary code. This issue only

affected Ubuntu 25.10 and Ubuntu 26.04 LTS. (CV...

Read the Full Advisory

Topics Covered

security advisory denial of service critical Ubuntu malicious payload libheif

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 26.04 LTS
  heif-gdk-pixbuf                 1.21.2-3ubuntu0.1
  heif-thumbnailer                1.21.2-3ubuntu0.1
  heif-view                       1.21.2-3ubuntu0.1
  libheif-dev                     1.21.2-3ubuntu0.1
  libheif-plugin-aomdec           1.21.2-3ubuntu0.1
  libheif-plugin-aomenc           1.21.2-3ubuntu0.1
  libheif-plugin-dav1d            1.21.2-3ubuntu0.1
  libheif-plugin-ffmpegdec        1.21.2-3ubuntu0.1
  libheif-plugin-j2kdec           1.21.2-3ubuntu0.1
  libheif-plugin-j2kenc           1.21.2-3ubuntu0.1
  libheif-plugin-jpegdec          1.21.2-3ubuntu0.1
  libheif-plugin-jpegenc          1.21.2-3ubuntu0.1
  libheif-plugin-kvazaar          1.21.2-3ubuntu0.1
  libheif-plugin-libde265         1.21.2-3ubuntu0.1
  libheif-plugin-rav1e            1.21.2-3ubuntu0.1
  libheif-plugin-svtenc           1.21.2-3ubuntu0.1
  libheif-plugin-x265             1.21.2-3ubuntu0.1
  libheif-plugins-all             1.21.2-3ubuntu0.1
  libheif1                        1.21.2-3ubuntu0.1

Ubuntu 25.10
  heif-gdk-pixbuf                 1.20.2-1ubuntu0.4
  heif-thumbnailer                1.20.2-1ubuntu0.4
  heif-view                       1.20.2-1ubuntu0.4
  libheif-dev                     1.20.2-1ubuntu0.4
  libheif-plugin-aomdec           1.20.2-1ubuntu0.4
  libheif-plugin-aomenc           1.20.2-1ubuntu0.4
  libheif-plugin-dav1d            1.20.2-1ubuntu0.4
  libheif-plugin-ffmpegdec        1.20.2-1ubuntu0.4
  libheif-plugin-j2kdec           1.20.2-1ubuntu0.4
  libheif-plugin-j2kenc           1.20.2-1ubuntu0.4
  libheif-plugin-jpegdec          1.20.2-1ubuntu0.4
  libheif-plugin-jpegenc          1.20.2-1ubuntu0.4
  libheif-plugin-kvazaar          1.20.2-1ubuntu0.4
  libheif-plugin-libde265         1.20.2-1ubuntu0.4
  libheif-plugin-rav1e            1.20.2-1ubuntu0.4
  libheif-plugin-svtenc           1.20.2-1ubuntu0.4
  libheif-plugin-x265             1.20.2-1ubuntu0.4
  libheif-plugins-all             1.20.2-1ubuntu0.4
  libheif1                        1.20.2-1ubuntu0.4

Ubuntu 24.04 LTS
  heif-gdk-pixbuf                 1.17.6-1ubuntu4.4
  heif-thumbnailer                1.17.6-1ubuntu4.4
  libheif-dev                     1.17.6-1ubuntu4.4
  libheif-plugin-aomdec           1.17.6-1ubuntu4.4
  libheif-plugin-aomenc           1.17.6-1ubuntu4.4
  libheif-plugin-dav1d            1.17.6-1ubuntu4.4
  libheif-plugin-ffmpegdec        1.17.6-1ubuntu4.4
  libheif-plugin-j2kdec           1.17.6-1ubuntu4.4
  libheif-plugin-j2kenc           1.17.6-1ubuntu4.4
  libheif-plugin-jpegdec          1.17.6-1ubuntu4.4
  libheif-plugin-jpegenc          1.17.6-1ubuntu4.4
  libheif-plugin-libde265         1.17.6-1ubuntu4.4
  libheif-plugin-rav1e            1.17.6-1ubuntu4.4
  libheif-plugin-svtenc           1.17.6-1ubuntu4.4
  libheif-plugin-x265             1.17.6-1ubuntu4.4
  libheif1                        1.17.6-1ubuntu4.4

Ubuntu 22.04 LTS
  heif-gdk-pixbuf                 1.12.0-2ubuntu0.1~esm3
                                  Available with Ubuntu Pro
  heif-thumbnailer                1.12.0-2ubuntu0.1~esm3
                                  Available with Ubuntu Pro
  libheif-dev                     1.12.0-2ubuntu0.1~esm3
                                  Available with Ubuntu Pro
  libheif1                        1.12.0-2ubuntu0.1~esm3
                                  Available with Ubuntu Pro

Ubuntu 20.04 LTS
  heif-gdk-pixbuf                 1.6.1-1ubuntu0.1~esm3
                                  Available with Ubuntu Pro
  heif-thumbnailer                1.6.1-1ubuntu0.1~esm3
                                  Available with Ubuntu Pro
  libheif-dev                     1.6.1-1ubuntu0.1~esm3
                                  Available with Ubuntu Pro
  libheif1                        1.6.1-1ubuntu0.1~esm3
                                  Available with Ubuntu Pro

Ubuntu 18.04 LTS
  libheif-dev                     1.1.0-2ubuntu0.1~esm3
                                  Available with Ubuntu Pro
  libheif1                        1.1.0-2ubuntu0.1~esm3
                                  Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.