Security1 publisher2 min readPublished
One independent developer fixed 37 libheif and libde265 security advisories in 2026
The project's own README puts the 2026 advisory count at 37 and the maintenance roster at one independent developer with almost no recurring funding. Products that decode HEIC or AVIF inherit that pace.
The Watch · Security desk
What happened
- HEIC decoding runs through libde265 by default and AVIF through libaom, dav1d, svt-av1 or rav1e, with VVC, AVC, JPEG, JPEG-2000 and ISO/IEC 23001-17 also supported.
- A single decoding call handles any of those formats, because the decoder supports HEIF and AVIF through the same API.
- Anyone whose product or service includes libheif is directed to the project's Funding and Commercial support section, and security issues are reported through SECURITY.md.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- exposure Any service that decodes user-supplied HEIC or AVIF is reachable through whichever codec path the file names, including codec paths the product never meant to accept.
- cost Downstream release engineering absorbs a rebuild and a ship for each advisory.
- decision Shipping teams face a funding question: pay for commercial support, or keep drawing fixes from an unpaid queue.
- constraint A patch SLA promised to customers can only be met as fast as upstream releases the fix, and upstream is one developer.
A HEIC file is a container before it is an image. libheif walks the box structure and item references, then the tile grids, overlay layers, thumbnails and auxiliary images, then the alpha and depth channels, then the EXIF and XMP blocks [7][8]. All of that is parsing work on bytes someone else supplied. The library also reads HEIF image sequences and MP4 video, and it can request data over the network through a data-reader interface [9][10].
The file picks the codec. libheif's decoder handles HEIF and AVIF through the same API, and the same decoding code decodes any of the supported formats [5]. A build that links libde265 for HEVC and dav1d for AV1 lets the uploaded file decide which of the two runs [3].
The status note is dated August 2026 [12]. If all 37 advisories landed in the first eight months of the year, that is about 4.6 a month, one every six or seven days [13]. Each was investigated, fixed and released by the same developer [1].
The README puts it in one sentence: "libheif and libde265 are maintained by a single independent developer with almost no recurring funding, while 37 security advisories had to be investigated, fixed and released in 2026 alone" [1].
The note does not name the advisories or their severities [14], so exploitability per bug cannot be rated from it.
Build options are the cheapest place for a downstream team to cut exposure. libheif can be compiled with a subset of the supported codecs, or with the codecs built as separate plugins that load dynamically [6]. A product that only decodes AVIF can leave out the HEVC path, and with it libde265 and x265 [3][6]. One that only decodes HEIC does not need libaom, dav1d, svt-av1 and rav1e in the image [3]. The ISO/IEC 23001-17 codec is built into libheif and stays either way [4].
For teams that need the full codec set, the README's instruction to anyone whose product or service includes libheif is to read its Funding and Commercial support section, and security reports go through SECURITY.md [11].
What to watch
- Whether the advisory count keeps climbing after the August 2026 status note, and whether libheif or libde265 carries more of it.
- Whether recurring funding or a commercial support arrangement appears on the project's funding page.
- Whether downstream packagers start shipping libheif with a reduced codec set instead of the full plugin list.