BlackTreeLifecycle intelligence
Evidence-linked product lifecycle intelligenceSUPPORT · SECURITY · RETIREMENT
← Lifecycle catalogue
DEBIAN SECURITY ADVISORYDEBIANVERIFIED

PUBLISHER UPDATE · DSA-6523-1

DSA-6523-1 release notes and known issues

DSA-6523-1 libheif - security update

Scope: Debian. This update record adds version, fix and known-issue context. Its publication date is not a lifecycle boundary.

Summary

Multiple security issues were discovered in libheif, an ISO/IEC 23008-12 HEIF and AVIF image file format decoder and encoder, which may result in denial of service, the disclosure of sensitive memory contents or, potentially, the execution of arbitrary code if a malformed image file is processed. Besides the CVEs listed above, this update also fixes a number of issues tracked upstream as GHSA-x8r2-mggj-j6wr, GHSA-w7mc-p8jc-p853, GHSA-9rj8-5mp5-26c9, GHSA-4jqm-2x34-6f6r, GHSA-vg7w-rp49-4fc2, GHSA-5w8x-856j-7x7c, GHSA-fqpw-fj22-78w4, GHSA-prgh-72vc-3xmc, GHSA-xrp2-63fq-jm8q, GHSA-4rv4-953r-p24q and GHSA-rhgw-q5g8-xjh2, and had no CVE assigned when this advisory was published. https://security-tracker.debian.org/tracker/DSA-6523-1

Improvements and security content

  • Multiple security issues were discovered in libheif, an ISO/IEC 23008-12 HEIF and AVIF image file format decoder and encoder, which may result in denial of service, the disclosure of sensitive memory contents or, potentially, the execution of arbitrary code if a malformed image file is processed. Besides the CVEs listed above, this update also fixes a number of issues tracked upstream as GHSA-x8r2-mggj-j6wr, GHSA-w7mc-p8jc-p853, GHSA-9rj8-5mp5-26c9, GHSA-4jqm-2x34-6f6r, GHSA-vg7w-rp49-4fc2, GHSA-5w8x-856j-7x7c, GHSA-fqpw-fj22-78w4, GHSA-prgh-72vc-3xmc, GHSA-xrp2-63fq-jm8q, GHSA-4rv4-953r-p24q and GHSA-rhgw-q5g8-xjh2, and had no CVE assigned when this advisory was published. https://security-tracker.debian.org/tracker/DSA-6523-1

Known issues

Publisher statement

Not stated. The verified publisher record does not contain a known-issues statement.

Affected products and versions

Products

  • Debian

Affected versions

  • See the official publisher source for applicability.

Fixed versions or updates

  • No fixed version is stated in this record.

Recommended action

Review the official publisher document before deployment.

These links connect the publisher update to related Lifecycle records without treating the update publication date as an end-of-support date.

Debian 12 BookwormOpen lifecycle record →

Official publisher evidence

DEBIANVERIFIED

DSA-6523-1 libheif - security update

Checked 11 Oct 2026. BlackTree preserves the last verified facts if a later source check is temporarily unavailable.

Open the official publisher source