libheif: Incomplete fix for CVE-2026-62292 leaves libheif vulnerable to an out-of-bounds read

libheif: Wrapped icef compressed-unit range check causes out-of-bounds read in uncompressed HEIF decoder

libheif allows Out-of-bounds vector access leading to invalid dereference (DoS)

libheif: Uninitialized Heap Memory Information Leak via Failed Grid Tiles

libheif is Vulnerable to Infinite Loop DoS via stts Sample Duration Lookup

libheif has a Heap OOB Read/SEGV Crash via Zero samples_per_chunk

libheif Has Heap Buffer Overflow in `Track::get_next_sample_raw_data()` -- OOB Chunk Vector Access

libheif has an incomplete fix for CVE-2026-3949: integer overflow bypass in vvdec_push_data2

libheif has integer overflow in inline mask size calculation that causes undersized buffer allocation

libheif has a NULL pointer dereference in heif_image_handle_get_image_tiling for malformed unci image missing ispe

libheif: Heap out of bounds write in libheif uncompressed encoder when writing images with mismatched auxiliary alpha dimensions

libheif: `clap` + oversized `ispe` aborts on an assert in `Fraction::Fraction` (incomplete fix for CVE-2026-62289)

libheif: Reachable assertion in HeifContext::get_track() aborts on a valid-but-empty HEIF sequence file (context.cc:2110)

libheif: Integer underflow in Fraction constructor via double clap transform application

libheif: Heap out-of-bounds read in libheif inline-mask region API (heif_region_item_add_region_inline_mask_data / heif_region_get_mask_image)