@slyborg @MastodonEngineering there's a bunch of them, just looking at https://security-tracker.debian.org/tracker/source-package/libheif will give you a good idea
all the issues known to us are fixed in the latest libheif version, but these have not reached major distributions that admins actually use; since we rely on system-wide libvips and libheif, we can't reasonably ensure that admins have up-to-date versions