CVE-2026-84383 Details

A heap buffer overflow vulnerability has been identified in libheif, a library for decoding and encoding HEIF and AVIF file formats. This vulnerability exists in versions 1.22.0 prior to 1.23.2. The issue arises in the HeifPixelImage class, specifically within the transfer_channel_from_image_as() method. The vulnerability can be exploited by a crafted HEIF, HEIC, or AVIF file that uses nested iden and auxl references to create a scenario where duplicate Alpha planes with varying bit depths are appended to the image storage. When the scale_nearest_neighbor() function is called, it allocates the destination Alpha plane based on the first plane's 8-bit depth, but then writes 10-bit or 12-bit samples into the 8-bit allocation. This mismatch leads to a heap out-of-bounds write, with the overflow size and written values being controllable by the attacker through the file's ISOBMFF container and HEVC bitstream content. The vulnerability can be triggered by processing the crafted file with the heif_decode_image() function, without the need for special API options or unusual calling patterns.

Users are advised to upgrade to libheif version 1.23.2, which addresses this vulnerability by rejecting duplicate Alpha planes and validating item sizes to prevent such exploitation.