DEBIANVERIFIED
DSA-6583-1 libheif - security update
Checked 30 Oct 2026. BlackTree preserves the last verified facts if a later source check is temporarily unavailable.
Open the official publisher source
← Lifecycle catalogue
DEBIAN SECURITY ADVISORYDEBIANVERIFIED
PUBLISHER UPDATE · DSA-6583-1
DSA-6583-1 release notes and known issues
DSA-6583-1 libheif - security update
Scope: Debian. This update record adds version, fix and known-issue context. Its publication date is not a lifecycle boundary.
Summary
Multiple security issues were discovered in libheif, a library for reading and writing HEIF and AVIF images. Processing specially crafted images could result in denial of service through excessive resource consumption or crashes, or disclosure of process memory. A use-after-free and double-free affecting timestamp handling during image encoding, including transcoding of crafted images, is also addressed. https://security-tracker.debian.org/tracker/DSA-6583-1
Improvements and security content
- Multiple security issues were discovered in libheif, a library for reading and writing HEIF and AVIF images. Processing specially crafted images could result in denial of service through excessive resource consumption or crashes, or disclosure of process memory. A use-after-free and double-free affecting timestamp handling during image encoding, including transcoding of crafted images, is also addressed. https://security-tracker.debian.org/tracker/DSA-6583-1
Known issues
Publisher statementNot stated. The verified publisher record does not contain a known-issues statement.
Affected products and versions
Products
- Debian
Affected versions
- See the official publisher source for applicability.
Fixed versions or updates
- No fixed version is stated in this record.
Recommended action
Review the official publisher document before deployment.
Lifecycle connections
These links connect the publisher update to related Lifecycle records without treating the update publication date as an end-of-support date.