YuImage: Version History

PNG

• Update libpng to v1.6.53.
  • Fixed CVE-2025-66293 (high severity): Out-of-bounds read in the simplified API when processing valid palette PNG images with partial transparency and gamma correction, triggered by completely valid, spec-compliant PNG files, no malicious crafting required. TYuPngImage was not affected, as it does not use the simplified API.

JPEG

• Update libjpeg-turbo to v3.1.2.
• Add SSE2 acceleration to YuJpegTurbo Huffman coding for Win32 Delphi.

PNG

• Update libpng to v1.6.51.
  • Fixed CVE-2025-64505 (moderate severity): Heap buffer overflow via malformed palette index.
  • Fixed CVE-2025-64506 (moderate severity): Heap buffer over-read in png_write_image_8bit with 8-bit input and convert_to_8bit enabled.
  • Fixed CVE-2025-64720 (high severity): Buffer overflow via incorrect palette premultiplication.
  • Fixed CVE-2025-65018 (high severity): Heap buffer overflow in png_combine_row triggered via png_image_finish_read.
  • Fixed a memory leak in png_set_quantize.

WebP:

• Integrate SIMD accelerations (AVX2, SSE2, SSE, MMX, 3DNow!) into YuWebP for Win32 Delphi XE2 and later. This optimization delivers about 2–3× faster WebP image encoding and decoding, sometimes even more.

• Support Delphi 13 Florence Win32 and Win64.

• Fix an access violation in WebPAnimEncoderAdd for Win32. Win64 was not affected.

• Update libjpeg-turbo to v3.1.1:
  • Hardened the libjpeg API against hypothetical calling applications that may erroneously change the value of jpeg_compress_struct.data_precision or jpeg_decompress_struct.data_precision after calling jpeg_start_compress or jpeg_start_decompress.
• Update libpng to v1.6.50:
  • Fixed a decoder defect in which unknown chunks trailing IDAT, set to go through the unknown chunk handler, incorrectly triggered out-of-place IEND errors.
  • Fixed the floating-point version of the mDCv setter png_set_mDCv.
• Update libwebp to v1.6.0:
  • Add WebPValidateDecoderConfig.
  • Additional x86 (AVX2, SSE2), general optimizations and compression improvements for lossless.
  • Miscellaneous bug fixes.

• Update libpng to v1.6.47:
  • Modified the behaviour of colorspace chunks in order to adhere to the new precedence rules formulated in the latest draft of the PNG Specification.

• Update libpng to v1.6.46:
  • Add support to read and write mDCV chunks.
  • Add support to read and write cLLI chunks.
  • Add support to read and write cICP chunks.
  • Adjust and improve various checks in colorspace calculations.
  • Rearrange the write order of colorspace chunks for better conformance with the PNG v3 draft specification.
• Update Little CMS to v2.17:
  • Allow to apply color management on memory blocks > 4 GB.
  • Fix cmsDupContext with nil ContextID.
  • Improve safety checks of GCATS parser.
  • Update cmsMD5computeID to the latest ICC 4.4 specification.
  • Fix gamut warning.
  • Fix some potential memory leaks.
• Add JPEG lossless transformation base functions to YuJpegTurbo.

• Update libwebp to v1.5.0:
  • cross_color_transform_bits added to WebPAuxStats.
  • Lossless encoder speed and compression improvements.
  • Lossless encoding does not use floats anymore.
  • Security related hardening.
• Fix some Delphi compiler warnings.

• Add new libjpeg-turbo v3.1.0 Delphi implementation, a JPEG image codec that uses SIMD instructions (MMX, SSE2, AVX2, Neon) to accelerate baseline JPEG compression and decompression.
  • TYuJpegImage: A TGraphic descendant to load and display JPEG images, and optionally apply embedded ICC color profiles.
  • YuJpegTurbo unit featuring the libjpeg v8 API.
  • YuTurboJpeg unit for generating, decoding, and transforming planar YUV and JPEG images in memory.
• New procedures to save TBitmap to
  • PNG – TBitmap_SaveAsPng
  • JPEG – TBitmap_SaveAsJpeg
  • WebP – TBitmap_SaveAsWebP
• Update libpng to v1.6.44:
  • Fix the row width check in png_get_IHDR.
  • Add eXIf chunk support to the push-mode reader.
• Update libwebp to v1.4.0:
  • New APIs WebPAnimEncoderSetChunk, WebPAnimEncoderGetChunk, WebPAnimEncoderDeleteChunk
  • Security related hardening.
  • Some minor optimizations in the lossless encoder.
  • Miscellaneous bug fixes.

Update Little CMS to v2.16:

• New: Import .CUBE files as RGB devicelinks.
• New: Read/Write MHC2 tags for Windows GPU access.
• New: Support for UTF-8 on multilocalized unicode functions.
• New: Suppot for OkLab color space, built-in and formatter.
• Improved: Accuarcy of floating point transformations.
• Improved: Platform and creator information now survives profile edition.

• Update libwebp to v1.3.2:
  • Fix a critical security out of bounds (OOB) bug in the lossless decoder (CVE-2023-4863).

• Support Delphi 12 Athens Win32 and Win64.

• Update libwebp to v1.3.1 final:
  • Security fixes for lossless encoder (CVE-2023-1999).
  • Improve error reporting through WebPPicture error codes.

• Update libpng to v1.6.40:
  • Ensure that only one eXIf chunk is written in the entire datastream.
  • Fix png_get_valid to not report a tRNS chunk as valid if it was canceled.
  • Fix a memory leak when allocation of a pCAL buffer fails.
• Update libwebp to latest v1.3.1-rc1:
  • Add missing error checks.

Initial release as YuImage. YuImage supersedes YuPng and adds the following:

• New YuWebP unit based on libwebp v1.3.31-rc1:
  • WebP decoder and encoder.
  • WebP container muxer and demuxer.
  • WebP animation encoder.
• YuWebPImage unit with TYuWebPImage class, a TGraphic descendant to display WebP images:
  • Load and decode WebP images.
  • Apply embedded ICC color profiles.
  • Paint with full alpha transparency.
  • Display WebP animations.
• Update Little CMS to v2.15.

• Initial release, with libpng v1.6.39 and Little CMS v2.14.