CVE-2026-84444 Details
Description
libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, when WITH_UNCOMPRESSED_CODEC is enabled, heif_context_add_image_tile() accepts an independently constructed tile whose component-plane dimensions do not match the tile geometry established by the prototype image. ImageItem_uncompressed::add_image_tile() passes that tile directly to unc_encoder::encode_tile(), which lacked the check_component_sizes() gate and sizes its output from the configured tile geometry while copying the tile's actual component-plane dimensions. An oversized component plane can therefore make unc_encoder_component_interleave::encode_tile() copy attacker-controlled data beyond the heap output buffer. This issue is fixed in version 1.23.2.
A heap buffer overflow vulnerability has been identified in libheif versions prior to 1.23.2. When the uncompressed codec is enabled, the function heif_context_add_image_tile() can be exploited by providing a tile with component-plane dimensions that do not align with the tile geometry of the prototype image. This discrepancy allows for an out-of-bounds write, as the encoder copies data from the tile's planes using their actual sizes, which can exceed the allocated buffer based on the declared dimensions. The vulnerability arises because the uncompressed encoder does not validate component sizes before processing tiles, leading to a heap overflow with attacker-controlled data.
Users are advised to upgrade to libheif version 1.23.2, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 18, 2026CISA-ADP
Assessed Sep 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/strukturag/libheif/security/advisories/GHSA-j264-xvrp-5v7q | CISA-ADP | AdvisoryBundleRemedyVendor |
| https://github.com/strukturag/libheif/commit/e65071f59a1ac08aa1eb0d07a831deaf6bb4d03b | [email protected] | Source CodeVendor |
| https://github.com/strukturag/libheif/releases/tag/v1.23.2 | [email protected] | Release NotesVendor |
| https://github.com/strukturag/libheif/security/advisories/GHSA-j264-xvrp-5v7q | [email protected] | AdvisoryBundleRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-787 | Out-of-bounds Write | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| strukturag libheif | <= 1.23.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 22, 2026 | CVE Modified | CISA-ADP |
| Sep 18, 2026 | New CVE Received | [email protected] |