CVE-2026-84384 Details
Description
libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.2, crafted HEIF or AVIF mime metadata and unci image data can cause decompress_brotli() and do_inflate() to grow accumulated output without an effective size limit or MemoryHandle accounting. The brotli path has no output bound, while the zlib path checks only a small temporary buffer in a branch that valid streams do not reach, and overlapping icef units can decompress the same payload repeatedly. HeifContext::interpret_heif_file_images() processes multiple compressed metadata items during file opening, allowing a small file to consume unbounded memory and terminate the process. This issue is fixed in version 1.23.2.
A vulnerability in libheif versions 1.19.0 prior to 1.23.2 allows for unbounded memory allocation through improper handling of decompression in the Brotli and Zlib libraries. This issue arises when the 'mime' metadata and 'unci' image data are processed, leading to a denial-of-service condition by exhausting available memory. The problem is exacerbated by overlapping units in the 'unci' data, which can be decompressed multiple times, further amplifying the memory usage.
Users are advised to upgrade to libheif version 1.23.2, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 18, 2026CISA-ADP
Assessed Sep 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/strukturag/libheif/security/advisories/GHSA-24wx-9w62-c96w | CISA-ADP | AdvisoryBundleExploitRemedyVendor |
| https://github.com/strukturag/libheif/commit/21893e8f66c8b79363ca2809391b07d35e1a95ec | [email protected] | Source CodeVendor |
| https://github.com/strukturag/libheif/releases/tag/v1.23.2 | [email protected] | Release NotesVendor |
| https://github.com/strukturag/libheif/security/advisories/GHSA-24wx-9w62-c96w | [email protected] | AdvisoryBundleExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-409 | Improper Handling of Highly Compressed Data (Data Amplification) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| libheif | <= 1.23.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 18, 2026 | CVE Modified | CISA-ADP |
| Sep 18, 2026 | New CVE Received | [email protected] |