Topic

Image codec security

Vulnerabilities and hardening in libraries that parse and decode image formats such as HEIF, AVIF and JPEG 2000, where crafted files are a common attack input.

Current clusters

security1 publisher

libheif 1.23.5 blocks a 351-byte AVIF that forced allocations of more than 10 GB

libheif v1.23.5 fixes a high-rated flaw that let a 351-byte AVIF file force decoder allocations of more than 10 GB. It is a drop-in replacement for v1.23.4 and also closes six lower-rated memory-handling bugs.

Publishers:github.com

Reality

Evidence60
Adoption: Insufficient
Hype gap+10
Incentives: Insufficient
Confidence55