# struktur AG Libheif vulnerabilities

Source: https://junglewise.ai/threats/technologies/libheif  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour.  
Data: https://junglewise.ai/threats/technologies/libheif.json  
License: CC BY 4.0 with a link back

Junglewise Threat Intelligence has tracked 19 vulnerabilities in struktur AG Libheif: 0 in the last 7 days and 3 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-84384, was published on 18 September 2026. Nothing in the last four weeks, down from 1 vulnerability in the four before.

## Counts

- Last 7 days: 0
- Last 30 days: 0
- Last 90 days: 3
- All time: 19 (0 critical, 0 exploited in the wild)

## About struktur AG Libheif

An ISO/IEC 23008-12:2017 HEIF and AVIF file format decoder and encoder.

## Latest struktur AG Libheif vulnerabilities

- [CVE-2026-84384: libheif decompression bomb via brotli/zlib metadata](https://junglewise.ai/threats/cve-2026-84384-libheif-is-a-heif-and-avif-file-format-decoder-and-encoder-from-1) (high, CVSS 7.5, published 18 Sep 2026)
- [sharp remote code execution via malformed HEIF image](https://junglewise.ai/threats/sharp-remote-code-execution-via-malformed-heif-image-32a48ae6) (medium, CVSS 4, published 8 Sep 2026)
- [Next.js and libheif RCE in HEIF/AVIF image processing](https://junglewise.ai/threats/next-js-and-libheif-rce-in-heif-avif-image-processing-eebb5345) (info, CVSS 9.8, published 25 Aug 2026)
- [CVE-2026-48029: Strukturag libheif heap OOB read in ImageItem_Grid::decode_grid_tile](https://junglewise.ai/threats/cve-2026-48029-strukturag-libheif-heap-oob-read-in-imageitem-grid-decode-grid) (high, CVSS 7.1, published 22 Jul 2026)
- [CVE-2026-47709: Strukturag libheif NULL pointer dereference in heif_image_handle_get_image_tiling](https://junglewise.ai/threats/cve-2026-47709-strukturag-libheif-null-pointer-dereference-in-heif-image-handle) (info, CVSS 6.9, published 21 Jul 2026)
- [CVE-2026-47254: Strukturag libheif heap buffer overflow in Track sequence handling](https://junglewise.ai/threats/cve-2026-47254-strukturag-libheif-heap-buffer-overflow-in-track-sequence) (medium, CVSS 6.1, published 21 Jul 2026)
- [CVE-2026-47251: libheif integer overflow in vvdec_push_data2](https://junglewise.ai/threats/cve-2026-47251-libheif-integer-overflow-in-vvdec-push-data2) (info, CVSS 6.8, published 21 Jul 2026)
- [CVE-2026-47247: Strukturag libheif heap information disclosure in grid image decoding](https://junglewise.ai/threats/cve-2026-47247-strukturag-libheif-heap-information-disclosure-in-grid-image) (high, CVSS 7.5, published 21 Jul 2026)
- [CVE-2026-47178: Strukturag libheif heap out-of-bounds write in uncompressed tile decoder](https://junglewise.ai/threats/cve-2026-47178-strukturag-libheif-heap-out-of-bounds-write-in-uncompressed-tile) (medium, CVSS 6.1, published 21 Jul 2026)
- [CVE-2026-47714: Strukturag libheif integer overflow in region.cc mask parsing](https://junglewise.ai/threats/cve-2026-47714-strukturag-libheif-integer-overflow-in-region-cc-mask-parsing) (medium, CVSS 6.1, published 21 Jul 2026)
- [CVE-2026-49271: libheif out-of-bounds read in uncompressed HEIF decoder](https://junglewise.ai/threats/cve-2026-49271-libheif-out-of-bounds-read-in-uncompressed-heif-decoder) (medium, CVSS 6.5, published 19 Jun 2026)
- [CVE-2026-41071: Strukturag libheif heap buffer over-read in SampleAuxInfoReader](https://junglewise.ai/threats/cve-2026-41071-strukturag-libheif-heap-buffer-over-read-in-sampleauxinforeader) (info, CVSS 5.1, published 22 May 2026)
- [CVE-2026-41069: Strukturag libheif out-of-bounds read in SampleAuxInfoReader](https://junglewise.ai/threats/cve-2026-41069-strukturag-libheif-out-of-bounds-read-in-sampleauxinforeader) (medium, CVSS 6.5, published 22 May 2026)
- [CVE-2026-32882: libheif heap buffer over-read in HeifPixelImage::overlay](https://junglewise.ai/threats/cve-2026-32882-libheif-heap-buffer-over-read-in-heifpixelimage-overlay) (high, CVSS 7.1, published 19 May 2026)
- [CVE-2026-32814: Strukturag libheif uninitialized heap memory leak in grid image decoding](https://junglewise.ai/threats/cve-2026-32814-strukturag-libheif-uninitialized-heap-memory-leak-in-grid-image) (medium, CVSS 6.5, published 19 May 2026)
- [CVE-2026-32741: Strukturag libheif heap buffer overflow in MaskImageCodec](https://junglewise.ai/threats/cve-2026-32741-strukturag-libheif-heap-buffer-overflow-in-maskimagecodec) (high, CVSS 7.1, published 19 May 2026)
- [CVE-2026-32740: Strukturag libheif heap buffer overflow in grid tile compositing](https://junglewise.ai/threats/cve-2026-32740-strukturag-libheif-heap-buffer-overflow-in-grid-tile-compositing) (high, CVSS 8.8, published 19 May 2026)
- [CVE-2026-32739: Strukturag libheif infinite loop in Box_stts::get_sample_duration](https://junglewise.ai/threats/cve-2026-32739-strukturag-libheif-infinite-loop-in-box-stts-get-sample-duration) (medium, CVSS 6.5, published 19 May 2026)
- [CVE-2026-32738: Strukturag libheif denial of service via integer underflow in stsc box](https://junglewise.ai/threats/cve-2026-32738-strukturag-libheif-denial-of-service-via-integer-underflow-in) (medium, CVSS 6.5, published 19 May 2026)

## Most severe struktur AG Libheif vulnerabilities

- [CVE-2026-32740: Strukturag libheif heap buffer overflow in grid tile compositing](https://junglewise.ai/threats/cve-2026-32740-strukturag-libheif-heap-buffer-overflow-in-grid-tile-compositing) (high, CVSS 8.8, published 19 May 2026)
- [CVE-2026-84384: libheif decompression bomb via brotli/zlib metadata](https://junglewise.ai/threats/cve-2026-84384-libheif-is-a-heif-and-avif-file-format-decoder-and-encoder-from-1) (high, CVSS 7.5, published 18 Sep 2026)
- [CVE-2026-47247: Strukturag libheif heap information disclosure in grid image decoding](https://junglewise.ai/threats/cve-2026-47247-strukturag-libheif-heap-information-disclosure-in-grid-image) (high, CVSS 7.5, published 21 Jul 2026)
- [CVE-2026-48029: Strukturag libheif heap OOB read in ImageItem_Grid::decode_grid_tile](https://junglewise.ai/threats/cve-2026-48029-strukturag-libheif-heap-oob-read-in-imageitem-grid-decode-grid) (high, CVSS 7.1, published 22 Jul 2026)
- [CVE-2026-32882: libheif heap buffer over-read in HeifPixelImage::overlay](https://junglewise.ai/threats/cve-2026-32882-libheif-heap-buffer-over-read-in-heifpixelimage-overlay) (high, CVSS 7.1, published 19 May 2026)
- [CVE-2026-32741: Strukturag libheif heap buffer overflow in MaskImageCodec](https://junglewise.ai/threats/cve-2026-32741-strukturag-libheif-heap-buffer-overflow-in-maskimagecodec) (high, CVSS 7.1, published 19 May 2026)
- [CVE-2026-41069: Strukturag libheif out-of-bounds read in SampleAuxInfoReader](https://junglewise.ai/threats/cve-2026-41069-strukturag-libheif-out-of-bounds-read-in-sampleauxinforeader) (medium, CVSS 6.5, published 22 May 2026)
- [CVE-2026-49271: libheif out-of-bounds read in uncompressed HEIF decoder](https://junglewise.ai/threats/cve-2026-49271-libheif-out-of-bounds-read-in-uncompressed-heif-decoder) (medium, CVSS 6.5, published 19 Jun 2026)
- [CVE-2026-32814: Strukturag libheif uninitialized heap memory leak in grid image decoding](https://junglewise.ai/threats/cve-2026-32814-strukturag-libheif-uninitialized-heap-memory-leak-in-grid-image) (medium, CVSS 6.5, published 19 May 2026)
- [CVE-2026-32739: Strukturag libheif infinite loop in Box_stts::get_sample_duration](https://junglewise.ai/threats/cve-2026-32739-strukturag-libheif-infinite-loop-in-box-stts-get-sample-duration) (medium, CVSS 6.5, published 19 May 2026)

## Vulnerabilities per week

Nothing in the last four weeks, down from 1 vulnerability in the four before.

| Week of | Vulns | Critical | Exploited |
| --- | --- | --- | --- |
| 17 Aug 2026 | 0 | 0 | 0 |
| 24 Aug 2026 | 1 | 0 | 0 |
| 31 Aug 2026 | 0 | 0 | 0 |
| 7 Sep 2026 | 1 | 0 | 0 |
| 14 Sep 2026 | 1 | 0 | 0 |
| 21 Sep 2026 | 0 | 0 | 0 |
| 28 Sep 2026 | 0 | 0 | 0 |
| 5 Oct 2026 | 0 | 0 | 0 |
| 12 Oct 2026 | 0 | 0 | 0 |
| 19 Oct 2026 | 0 | 0 | 0 |
| 26 Oct 2026 | 0 | 0 | 0 |
| 2 Nov 2026 | 0 | 0 | 0 |
| 9 Nov 2026 | 0 | 0 | 0 |

## Other struktur AG technologies

- [struktur AG Libde265](https://junglewise.ai/threats/technologies/libde265): 7 vulnerabilities

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "struktur AG Libheif vulnerabilities", https://junglewise.ai/threats/technologies/libheif, 9 November 2026.