YuImage: Version History

JPEG

• Update libjpeg-turbo to v3.1.4.1.
  • Hardened the libjpeg API against hypothetical applications that may erroneously set one of the exposed quantization table values to 0 just before calling jpeg_start_compress. (This would never happen in a correctly-written program, because jpeg_add_quant_table clamps all values less than 1.)
  • Fixed an issue in tj3Transform whereby, if TJPARAM_SAVEMARKERS was set to 2 or 4, TJXOPT_COPYNONE was not specified, an ICC profile was extracted from the source image, and another ICC profile was associated with the TurboJPEG instance using tj3SetICCProfile, both profiles were embedded in the destination image. The documented API behavior is for TJXOPT_COPYNONE to take precedence over TJPARAM_SAVEMARKERS and for TJPARAM_SAVEMARKERS to take precedence over the associated ICC profile. Thus, tj3Transform now ignores the associated ICC profile unless TJXOPT_COPYNONE is specified or TJPARAM_SAVEMARKERS is set to something other than 2 or 4.
  • Fixed an oversight in the libjpeg API whereby, if a calling application manually set cinfo.Ss (the predictor selection value) to a value less than 1 or greater than 7 after calling jpeg_enable_lossless and prior to calling jpeg_start_compress, an incorrect (all white) lossless JPEG image was silently generated.
  • Further hardened the TurboJPEG Java API against hypothetical applications that may erroneously pass huge values to one of the compression, YUV encoding, decompression, YUV decoding, or packed-pixel image I/O methods, leading to signed integer overflow in the JNI wrapper's buffer size checks that rendered those checks ineffective.

PNG

• TYuPngImage:
  • Fixed an access violation that occurred when processing grayscale images with a cHRM chunk.
  • Do not raise an exception if creating a color profile transform fails; instead, fall back to non-profile transformations.
• Update libpng to v1.6.58.
  • Fixed CVE-2026-33416 (high severity): Use-after-free via pointer aliasing in png_set_tRNS and png_set_PLTE.
  • Fixed CVE-2026-34757 (medium severity): Use-after-free in png_set_PLTE, png_set_tRNS and png_set_hIST leading to corrupted chunk data and potential heap information disclosure. Also hardened the append-style setters (png_set_text, png_set_sPLT, png_set_unknown_chunks) against a theoretical variant of the same aliasing pattern.
  • Fixed uninitialized reads beyond num_trans in trans_alpha buffers.
  • Fixed stale info_ptr->palette after in-place gamma and background transforms.
  • Fixed wrong channel indices in png_image_read_and_map RGB_ALPHA path.
  • Fixed wrong background color in colormap read.
  • Fixed integer overflow in rowbytes computation in read transforms.
  • Fixed dead loop in sPLT write.
  • Added missing null pointer checks in four public API functions.
  • Validated shift bit depths in png_set_shift to prevent infinite loop.
  • Various refactorings and cleanups.

PNG

• Update libpng to v1.6.55.
  • Fixed CVE-2026-25646 (high severity): Heap buffer overflow in png_set_quantize.

Little CMS

• Update Little CMS to v2.18.
  1. Critical safety fixes – Several bugs that could crash an application or corrupt memory were eliminated:
     • A signed-integer overflow that could raise floating point exception integer overflow.
     • An out-of-bounds read in the soft-proofing transform path using cmsCreateExtendedTransform.
     • A heap-buffer overflow in Unicode conversion.
  2. Robustness improvements – Additional checks were added to prevent misuse and undefined behaviour:
     • Guard clauses for out-of-bounds reads when printing text.
     • A division-by-zero safeguard for special case of CIECAM specification.
     • Validation of flag usage to avoid accidental misconfiguration.
  3. Correctness and compatibility enhancements – Various parsing, profiling, and platform-specific issues were resolved:
     • Fixed the CGATS parser’s handling of '+' signs.
     • Updated cmsCreateLab4Profile to reference the media white point instead of the illuminant.
     • Added support for localized descriptions in v2 profiles on macOS and corrected several tag-size and black-point detection problems.

PNG

• Update libpng to v1.6.54.
  • Fixed CVE-2026-22695 (medium severity): Heap buffer over-read.
  • Fixed CVE-2026-22801 (medium severity): Integer truncation causing heap buffer over-read

JPEG

• Update libjpeg-turbo to v3.1.3.
  • Hardened the TurboJPEG API against hypothetical applications that may erroneously call tj*Compress*() or tj*Transform() with a reused JPEG destination buffer pointer while specifying a destination buffer size of 0.
  • Hardened the TurboJPEG API against hypothetical applications that may erroneously set TJPARAM_LOSSLESS or TJPARAM_COLORSPACE prior to calling tj3EncodeYUV*8() or tj3CompressFromYUV*8(). tj3EncodeYUV*8() and tj3CompressFromYUV*8() now ignore TJPARAM_LOSSLESS and TJPARAM_COLORSPACE.

PNG

• Update libpng to v1.6.53.
  • Fixed CVE-2025-66293 (high severity): Out-of-bounds read in the simplified API when processing valid palette PNG images with partial transparency and gamma correction, triggered by completely valid, spec-compliant PNG files, no malicious crafting required. TYuPngImage was not affected, as it does not use the simplified API.

JPEG

• Update libjpeg-turbo to v3.1.2.
• Add SSE2 acceleration to YuJpegTurbo Huffman coding for Win32 Delphi.

PNG

• Update libpng to v1.6.51.
  • Fixed CVE-2025-64505 (moderate severity): Heap buffer overflow via malformed palette index.
  • Fixed CVE-2025-64506 (moderate severity): Heap buffer over-read in png_write_image_8bit with 8-bit input and convert_to_8bit enabled.
  • Fixed CVE-2025-64720 (high severity): Buffer overflow via incorrect palette premultiplication.
  • Fixed CVE-2025-65018 (high severity): Heap buffer overflow in png_combine_row triggered via png_image_finish_read.
  • Fixed a memory leak in png_set_quantize.

WebP:

• Integrate SIMD accelerations (AVX2, SSE2, SSE, MMX, 3DNow!) into YuWebP for Win32 Delphi XE2 and later. This optimization delivers about 2–3× faster WebP image encoding and decoding, sometimes even more.

• Support Delphi 13 Florence Win32 and Win64.

• Fix an access violation in WebPAnimEncoderAdd for Win32. Win64 was not affected.

• Update libjpeg-turbo to v3.1.1:
  • Hardened the libjpeg API against hypothetical calling applications that may erroneously change the value of jpeg_compress_struct.data_precision or jpeg_decompress_struct.data_precision after calling jpeg_start_compress or jpeg_start_decompress.
• Update libpng to v1.6.50:
  • Fixed a decoder defect in which unknown chunks trailing IDAT, set to go through the unknown chunk handler, incorrectly triggered out-of-place IEND errors.
  • Fixed the floating-point version of the mDCv setter png_set_mDCv.
• Update libwebp to v1.6.0:
  • Add WebPValidateDecoderConfig.
  • Additional x86 (AVX2, SSE2), general optimizations and compression improvements for lossless.
  • Miscellaneous bug fixes.

• Update libpng to v1.6.47:
  • Modified the behaviour of colorspace chunks in order to adhere to the new precedence rules formulated in the latest draft of the PNG Specification.

• Update libpng to v1.6.46:
  • Add support to read and write mDCV chunks.
  • Add support to read and write cLLI chunks.
  • Add support to read and write cICP chunks.
  • Adjust and improve various checks in colorspace calculations.
  • Rearrange the write order of colorspace chunks for better conformance with the PNG v3 draft specification.
• Update Little CMS to v2.17:
  • Allow to apply color management on memory blocks > 4 GB.
  • Fix cmsDupContext with nil ContextID.
  • Improve safety checks of GCATS parser.
  • Update cmsMD5computeID to the latest ICC 4.4 specification.
  • Fix gamut warning.
  • Fix some potential memory leaks.
• Add JPEG lossless transformation base functions to YuJpegTurbo.

• Update libwebp to v1.5.0:
  • cross_color_transform_bits added to WebPAuxStats.
  • Lossless encoder speed and compression improvements.
  • Lossless encoding does not use floats anymore.
  • Security related hardening.
• Fix some Delphi compiler warnings.

• Add new libjpeg-turbo v3.1.0 Delphi implementation, a JPEG image codec that uses SIMD instructions (MMX, SSE2, AVX2, Neon) to accelerate baseline JPEG compression and decompression.
  • TYuJpegImage: A TGraphic descendant to load and display JPEG images, and optionally apply embedded ICC color profiles.
  • YuJpegTurbo unit featuring the libjpeg v8 API.
  • YuTurboJpeg unit for generating, decoding, and transforming planar YUV and JPEG images in memory.
• New procedures to save TBitmap to
  • PNG – TBitmap_SaveAsPng
  • JPEG – TBitmap_SaveAsJpeg
  • WebP – TBitmap_SaveAsWebP
• Update libpng to v1.6.44:
  • Fix the row width check in png_get_IHDR.
  • Add eXIf chunk support to the push-mode reader.
• Update libwebp to v1.4.0:
  • New APIs WebPAnimEncoderSetChunk, WebPAnimEncoderGetChunk, WebPAnimEncoderDeleteChunk
  • Security related hardening.
  • Some minor optimizations in the lossless encoder.
  • Miscellaneous bug fixes.

Update Little CMS to v2.16:

• New: Import .CUBE files as RGB devicelinks.
• New: Read/Write MHC2 tags for Windows GPU access.
• New: Support for UTF-8 on multilocalized unicode functions.
• New: Suppot for OkLab color space, built-in and formatter.
• Improved: Accuarcy of floating point transformations.
• Improved: Platform and creator information now survives profile edition.

• Update libwebp to v1.3.2:
  • Fix a critical security out of bounds (OOB) bug in the lossless decoder (CVE-2023-4863).

• Support Delphi 12 Athens Win32 and Win64.

• Update libwebp to v1.3.1 final:
  • Security fixes for lossless encoder (CVE-2023-1999).
  • Improve error reporting through WebPPicture error codes.

• Update libpng to v1.6.40:
  • Ensure that only one eXIf chunk is written in the entire datastream.
  • Fix png_get_valid to not report a tRNS chunk as valid if it was canceled.
  • Fix a memory leak when allocation of a pCAL buffer fails.
• Update libwebp to latest v1.3.1-rc1:
  • Add missing error checks.

Initial release as YuImage. YuImage supersedes YuPng and adds the following:

• New YuWebP unit based on libwebp v1.3.31-rc1:
  • WebP decoder and encoder.
  • WebP container muxer and demuxer.
  • WebP animation encoder.
• YuWebPImage unit with TYuWebPImage class, a TGraphic descendant to display WebP images:
  • Load and decode WebP images.
  • Apply embedded ICC color profiles.
  • Paint with full alpha transparency.
  • Display WebP animations.
• Update Little CMS to v2.15.

• Initial release, with libpng v1.6.39 and Little CMS v2.14.