libheif 1.4.0 has a use-after-free in heif::HeifContext::Image::setalphachannel in heifcontext.h because heifcontext.cc mishandles references to non-existing alpha images.
{ "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro", "binaries": [ { "binary_version": "1.1.0-2ubuntu0.1~esm1", "binary_name": "libheif-dev" }, { "binary_version": "1.1.0-2ubuntu0.1~esm1", "binary_name": "libheif-examples" }, { "binary_version": "1.1.0-2ubuntu0.1~esm1", "binary_name": "libheif1" } ] }