AIKIDO-2026-449263

TL;DR

This release fixes a cluster of memory safety and denial-of-service defects across libheif decoding and color conversion. GHSA-hh47-fhqr-cj2r (CVE-2026-84451) is an integer overflow in the uncompressed decoder no-icef tile range check that wraps a uint64_t sum, bypasses the bounds check, and drives an out-of-bounds read. GHSA-4h82-g446-83fm is a heap out-of-bounds read decoding odd-height 4:2:0 uncompressed sequence frames to RGB because chroma planes are allocated with floor division. GHSA-9rj8-5mp5-26c9 is an out-of-bounds read in RGB-to-YCbCr identity-matrix conversion that indexes the red plane with the blue plane's stride under mismatched per channel bit depths. GHSA-gh5q-69gg-c964 (CVE-2026-84450) aborts the process through a reachable Fraction assertion when a clap property is combined with an oversized ispe. GHSA-mw6f-29j3-76f4 bundles a null pointer dereference in the depth-image handle APIs, an unbounded EXIF allocation, and a TIFF division by zero. GHSA-8857-r8x5-7499 is undefined behavior from a negative bit-shift during HDR bit-depth up-conversion. The fixes add the missing bounds, null, and range checks.