CVE-2026-84450 Details
Description
libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.3, a crafted image item containing a clap property and an ispe width or height greater than INT32_MAX + 1 can reach crop calculations through heif_image_handle_get_image_tiling(). Box_clap::left_rounded() or Box_clap::top_rounded() passes the image dimension minus one to Fraction::Fraction(), whose uint32_t constructor uses an assertion as input validation, causing assert-enabled builds to abort. Release builds can instead compute invalid crop geometry, and the tiling API returns dimensions that the normal decode security limits reject. This issue is fixed in version 1.23.3.
A vulnerability exists in libheif versions 1.19.0 prior to 1.23.3, where a crafted image item with a 'clap' property and an 'ispe' dimension exceeding INT32_MAX + 1 can disrupt crop calculations. This issue arises because the 'clap' box's rounding methods pass the image dimensions to a Fraction constructor that asserts the values are within a valid range. In debug builds, this assertion failure causes the program to abort, while in release builds, it leads to the generation of invalid crop geometry. The vulnerability is particularly concerning because it allows the tiling API to return dimensions that bypass the library's normal security limits, potentially causing buffer overflows or memory corruption.
Users can upgrade to libheif version 1.23.3, which addresses this vulnerability by adding the necessary input validation to prevent oversized dimensions from causing assertion failures.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 18, 2026CISA-ADP
Assessed Sep 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/strukturag/libheif/commit/1c2df9c0e814f89716f3a4d85a444b2dbc63ad69 | [email protected] | Source CodeVendor |
| https://github.com/strukturag/libheif/releases/tag/v1.23.3 | [email protected] | Release NotesVendor |
| https://github.com/strukturag/libheif/security/advisories/GHSA-gh5q-69gg-c964 | [email protected] | AdvisoryBundleExploitTechnical AnalysisVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-617 | Reachable Assertion | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| libheif | >= 1.19.0, <= 1.23.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 21, 2026 | CVE Modified | CISA-ADP |
| Sep 18, 2026 | New CVE Received | [email protected] |