Commit d788e1ac for libheif

commit d788e1ac955a84dd9d17bad88a14e78eb88c6f13
Author: Dirk Farin <dirk.farin@gmail.com>
Date:   Sat Sep 19 13:19:43 2026 +0200

    SECURITY.md: exclude issues that only exist with an outdated codec library

    Reports that are reachable only through a codec library version with a
    known, already fixed vulnerability belong to that library and its CVE.
    libheif adds cheap pre-decode checks for such cases, but they are not
    libheif vulnerabilities. Ask reporters to build against a maintained
    codec version first.

diff --git a/SECURITY.md b/SECURITY.md
index 9d96a76e..4bdd7b53 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -108,6 +108,10 @@ metadata, region and uncompressed-codec (`unci`) code paths.
 * Issues that require the caller to violate the documented API contract, for example passing
   inconsistent plane sizes to the encoder. These are still fixed, because libheif tries to
   validate its inputs, but they are not vulnerabilities in libheif.
+* Issues that are only reachable with a codec library version that has a known, already fixed
+  vulnerability (for example an old OpenJPEG without its CVE-2020-6851 patch). libheif adds
+  pre-decode checks for such cases where they are cheap, but the vulnerability and its CVE
+  belong to the codec library. Build against a maintained codec version before reporting.
 * Issues in the example programs (`heif-enc`, `heif-dec`, `heif-info`, ...) that are not in the
   library itself, for example in the JPEG/PNG/TIFF/Y4M input readers.
 * Issues in APIs that are only available with `ENABLE_EXPERIMENTAL_FEATURES=ON`. These APIs