The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8454-1 advisory.

    Elhanan Haenel discovered that libheif incorrectly handled certain malformed HEIF sequence files. An     attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 25.10     and Ubuntu 26.04 LTS. (CVE-2026-32738)

    Elhanan Haenel discovered that libheif incorrectly handled certain malformed HEIF sequence files, leading     to an infinite loop. An attacker could possibly use this issue to cause libheif to use excessive     resources, resulting in a denial of service. This issue only affected Ubuntu 25.10 and Ubuntu 26.04 LTS.
    (CVE-2026-32739)

    Elhanan Haenel discovered that libheif incorrectly handled certain crafted HEIF/AVIF image files. An     attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue     only affected Ubuntu 25.10 and Ubuntu 26.04 LTS. (CVE-2026-32740)

    It was discovered that libheif incorrectly handled certain crafted HEIF files containing mask images. An     attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue     only affected Ubuntu 24.04 LTS, Ubuntu 25.10, and Ubuntu 26.04 LTS. (CVE-2026-32741)

    It was discovered that libheif incorrectly handled certain crafted grid-based HEIF/AVIF files. An attacker     could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 20.04 LTS,     Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 25.10, and Ubuntu 26.04 LTS. (CVE-2026-32814)

    It was discovered that libheif incorrectly handled certain crafted HEIF files when compositing overlay     images. An attacker could possibly use this issue to cause a denial of service or obtain sensitive     information. (CVE-2026-32882)

    It was discovered that libheif incorrectly handled certain crafted files. An attacker could possibly use     this issue to cause a denial of service. This issue only affected Ubuntu 25.10 and Ubuntu 26.04 LTS.
    (CVE-2026-3950)

    It was discovered that libheif incorrectly handled certain malformed HEIF sequence files. An attacker     could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 25.10 and     Ubuntu 26.04 LTS. (CVE-2026-41069)

    It was discovered that libheif incorrectly handled certain crafted HEIF sequence files. An attacker could     possibly use this issue to cause a denial of service. This issue only affected Ubuntu 25.10 and Ubuntu     26.04 LTS. (CVE-2026-41071)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : libheif vulnerabilities (USN-8454-1)

medium Nessus Plugin ID 321763

Version 1.3

Version 1.2

Version 1.1

Version 1.3 Jun 26, 2026, 4:08 PM Plugin metadata (Add IAVM Info) Plugin Feed: 202606261608
Version 1.2 Jun 22, 2026, 8:21 AM CVSS metrics ("CVSSv2 score" set to 9.4) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:C") CVSSv2 score source (changed from "CVE-2026-3950" to "CVE-2026-41071") CVSSv2 severity (based on CVE-2026-41071, severity increased from "Low" to "High") CVSSv3 score source (changed from "CVE-2026-41071" to none) Plugin Feed: 202606220821
Version 1.1 Jun 21, 2026, 5:21 AM New Plugin Feed: 202606210521