Kova Image 0.3.0 is Early Development. Security fixes target the current main branch. No stable release or long-term support commitment exists yet. Use the newest reviewed source; do not assume older preview builds are supported.

Use GitHub's private vulnerability reporting: Report a vulnerability. Please do not open a public issue with sensitive exploit details, weaponized media files or personal data. If private reporting is unavailable, open a minimal issue asking the maintainer for a private contact channel, without including the exploit or sample.

Include the affected commit/version, Windows version, reproduction steps, expected impact and a minimal sample when it is safe to share privately. Please allow time for investigation and a coordinated fix before disclosure. No response-time guarantee is made during early development.

Every opened image (JPEG, PNG/APNG, GIF, WebP, BMP, TIFF, ICO, AVIF, HEIC/HEIF, JPEG XL, SVG, camera RAW, TGA, PNM, QOI, DDS, HDR, EXR and farbfeld) and every MP4/MOV/WebM/MKV video and MP3/M4A/AAC/WAV/FLAC/Ogg/Opus/WMA audio file is untrusted input. If you enable Explorer previews, the thumbnail provider decodes such files for every program that shows thumbnails, without the user opening them. Decoder failures, parser bugs, overflow, memory exhaustion, animation corruption, file races and unintended file changes are security-relevant. Unsupported formats are rejected. SVG is drawn without scripts, animation or access to other files and the network; only images embedded as data: URLs are used. There is no application networking, telemetry or automatic upload path.

Input size, dimensions, decoded animation storage, cache size and request queues are bounded. Decoding runs on a worker and Rust decoder panics are caught. These measures are not process isolation: allocator aborts, native faults, codec scratch allocations and GPU memory remain limitations. Read security architecture before assessing claims.

Video parsing uses the bundled FFmpeg/dav1d libraries; audio-only playback uses installed Windows Media Foundation components. Local streams are admitted without user URLs; external MP4/MOV/M4A data references and compressed/reference movies are rejected. Video decoders read the retained handle through custom IO with network protocols and secondary opens disabled. Kova Image reads audio tags and cover pictures within fixed limits. The application downloads no codecs. Native codec faults and allocations are not isolated by Rust panic recovery. See video boundaries when reporting playback or parser problems.