# cve.now: Strukturag

The newest entries naming Strukturag as an affected vendor (up to 200), of 44 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-120208](https://cve.now/CVE-2026-120208.md): libheif 1.18.0 before 1.23.3 Heap Buffer Overflow via unci Mixed-Interleave Decoder (CVSS 7.7)
- [CVE-2026-84450](https://cve.now/CVE-2026-84450.md): libheif: \`clap\` + oversized \`ispe\` aborts on an assert in \`Fraction::Fraction\` (incomplete fix for CVE-2026-62289) (CVSS 4.3)
- [CVE-2026-84449](https://cve.now/CVE-2026-84449.md): libheif hOp\_RGB24\_32\_to\_YCbCr Memory Access Error / SEGV (CVSS 3.7)
- [CVE-2026-84451](https://cve.now/CVE-2026-84451.md): libheif: Incomplete fix for CVE-2026-62292 leaves libheif vulnerable to an out-of-bounds read (CVSS 6.5)
- [CVE-2026-84447](https://cve.now/CVE-2026-84447.md): libheif: Derived-image indirect reference chains and tiled offsets bypass decode caching and MemoryHandle limits, causing CPU/memory amplification DoS (CVSS 7.5)
- [CVE-2026-84384](https://cve.now/CVE-2026-84384.md): libheif: brotli/zlib decompression paths lack output-size limits, allowing decompression-bomb OOM/DoS (CVSS 7.5)
- [CVE-2026-84444](https://cve.now/CVE-2026-84444.md): libheif uncompressed tiled image encoding allows out-of-bounds write (CVSS 7.4)
- [CVE-2026-84383](https://cve.now/CVE-2026-84383.md): libheif: Heap buffer overflow in \`scale\_nearest\_neighbor()\` via duplicate Alpha planes from nested \`iden\`/\`auxl\` items (CVSS 9.8)
- [CVE-2026-84446](https://cve.now/CVE-2026-84446.md): libheif: Sequence decode timing-table initialization allows non-terminating loops and unbounded memory, bypassing max\_sequence\_frames (CVSS 7.5)
- [CVE-2026-84448](https://cve.now/CVE-2026-84448.md): libheif: Heap out-of-bounds read in libheif inline-mask region API (heif\_region\_item\_add\_region\_inline\_mask\_data / heif\_region\_get\_mask\_image) (CVSS 4.0)
- [CVE-2026-54241](https://cve.now/CVE-2026-54241.md): libde265: SAO sequential filter heap buffer overflow via signed integer overflow (CVSS 7.4)
- [CVE-2026-54240](https://cve.now/CVE-2026-54240.md): libde265: Pixel accessor signed integer overflow causes heap OOB read/write (CVSS 7.4)
- [CVE-2026-62377](https://cve.now/CVE-2026-62377.md): libheif: Reachable assertion in HeifContext::get\_track() aborts on a valid-but-empty HEIF sequence file (context.cc:2110) (CVSS 4.3)
- [CVE-2026-62291](https://cve.now/CVE-2026-62291.md): libheif: Heap out of bounds write in libheif uncompressed encoder when writing images with mismatched auxiliary alpha dimensions (CVSS 5.3)
- [CVE-2026-62292](https://cve.now/CVE-2026-62292.md): libheif: Out-of-bounds read in uncompressed unci tile range slicing (CVSS 8.7)
- [CVE-2026-62289](https://cve.now/CVE-2026-62289.md): libheif: Integer underflow in Fraction constructor via double clap transform application (CVSS 4.3)
- [CVE-2026-50142](https://cve.now/CVE-2026-50142.md): libheif: unbounded heap allocation in HEIF sequence parser (stsz fixed-size mode missing bound check) (CVSS 7.5)
- [CVE-2026-48029](https://cve.now/CVE-2026-48029.md): libheif: heap OOB read in ImageItem\_Grid::decode\_grid\_tile via irot-induced tile-coordinate underflow (CVSS 7.1)
- [CVE-2026-47709](https://cve.now/CVE-2026-47709.md): libheif has a NULL pointer dereference in heif\_image\_handle\_get\_image\_tiling for malformed unci image missing ispe (CVSS 6.9)
- [CVE-2026-47254](https://cve.now/CVE-2026-47254.md): libheif Has Heap Buffer Overflow in \`Track::get\_next\_sample\_raw\_data()\` -- OOB Chunk Vector Access (CVSS 6.1)
- [CVE-2026-47251](https://cve.now/CVE-2026-47251.md): libheif has an incomplete fix for CVE-2026-3949: integer overflow bypass in vvdec\_push\_data2 (CVSS 6.8)
- [CVE-2026-47247](https://cve.now/CVE-2026-47247.md): libheif Vulnerable to Heap Information Disclosure via Grid Image Gap + Uninitialized Pixel Plane Allocation (CVSS 7.5)
- [CVE-2026-47178](https://cve.now/CVE-2026-47178.md): libheif has Heap Out Of Bounds Write in unci subsystem (CVSS 6.1)
- [CVE-2026-47714](https://cve.now/CVE-2026-47714.md): libheif has integer overflow in inline mask size calculation that causes undersized buffer allocation (CVSS 6.1)
- [CVE-2026-45383](https://cve.now/CVE-2026-45383.md): libde265 has a heap buffer overflow (OOB read) in decode\_slice\_unit\_WPP() via out-of-bounds CtbAddrRStoTS access — libde265 \<= v1.0.18 (CVSS 6.9)
- [CVE-2026-45382](https://cve.now/CVE-2026-45382.md): libde265 has a heap-buffer-overflow READ in decode\_slice\_unit\_tiles via unvalidated PPS tile geometry (CVSS 6.9)
- [CVE-2026-49346](https://cve.now/CVE-2026-49346.md): libde265 has a heap buffer overflow in de265\_image\_get\_buffer via SPS dimension integer overflow (CVSS 7.1)
- [CVE-2026-49295](https://cve.now/CVE-2026-49295.md): libde265 has an out-of-bounds write in process\_reference\_picture\_set via predicted short-term RPS (CVSS 7.1)
- [CVE-2026-49337](https://cve.now/CVE-2026-49337.md): libde265 has an unbounded memory leak via orphaned slice headers in \`read\_slice\_NAL\` (CVSS 4.3)
- [CVE-2026-49271](https://cve.now/CVE-2026-49271.md): libheif: Wrapped icef compressed-unit range check causes out-of-bounds read in uncompressed HEIF decoder (CVSS 6.5)
- [CVE-2026-41071](https://cve.now/CVE-2026-41071.md): libheif: Heap buffer over-read in SampleAuxInfoReader via crafted HEIF sequence file with mismatched saiz sample count (CVSS 5.1)
- [CVE-2026-41069](https://cve.now/CVE-2026-41069.md): libheif allows Out-of-bounds vector access leading to invalid dereference (DoS) (CVSS 6.5)
- [CVE-2026-32882](https://cve.now/CVE-2026-32882.md): libheif: Heap Buffer OOB Read in overlay compositing due to wrong alpha stride (CVSS 7.1)
- [CVE-2026-32741](https://cve.now/CVE-2026-32741.md): libheif has a heap buffer overflow in decode\_mask\_image() (CVSS 7.1)
- [CVE-2026-32814](https://cve.now/CVE-2026-32814.md): libheif: Uninitialized Heap Memory Information Leak via Failed Grid Tiles (CVSS 6.5)
- [CVE-2026-32740](https://cve.now/CVE-2026-32740.md): libheif: Heap-Buffer-Overflow Write in Grid Tile Chroma Compositing (CVSS 8.8)
- [CVE-2026-32739](https://cve.now/CVE-2026-32739.md): libheif is Vulnerable to Infinite Loop DoS via stts Sample Duration Lookup (CVSS 6.5)
- [CVE-2026-32738](https://cve.now/CVE-2026-32738.md): libheif has a Heap OOB Read/SEGV Crash via Zero samples\_per\_chunk (CVSS 6.5)
- [CVE-2026-33164](https://cve.now/CVE-2026-33164.md): NULL Pointer Dereference in libde265 (CVSS 8.7)
- [CVE-2026-33165](https://cve.now/CVE-2026-33165.md): heap out-of-bounds write in libde265 1.0.16 (CVSS 5.5)
- [CVE-2026-3950](https://cve.now/CVE-2026-3950.md): strukturag libheif stsz/stts track.cc load out-of-bounds (CVSS 4.8)
- [CVE-2026-3949](https://cve.now/CVE-2026-3949.md): strukturag libheif HEIF File decoder\_vvdec.cc vvdec\_push\_data2 out-of-bounds (CVSS 4.8)
- [CVE-2025-68431](https://cve.now/CVE-2025-68431.md): libheif has Potential Heap Buffer Over-Read (CVSS 6.5)
- [CVE-2022-1253](https://cve.now/CVE-2022-1253.md): Heap-based Buffer Overflow in strukturag/libde265 (CVSS 7.4)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/strukturag
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.