CVE-2026-84451 Details
Description
libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.3, the no-icef full-item branch of unc_decoder::get_compressed_image_data_uncompressed() in libheif/codecs/uncompressed/unc_decoder.cc retains an addition-based range check that can wrap when a crafted uncompressed tile grid produces a large range_start_offset and range_size. The overflow makes the bounds comparison pass and allows heif_image_handle_decode_image_tile() to call memcpy() with an invalid source pointer and a very large length when decoding a valid high-index advertised tile. This incomplete remediation of CVE-2026-62292 can reliably crash tile-processing applications, while whole-image decoding is not claimed to reach the demonstrated path. This issue is fixed in version 1.23.3.
A heap out-of-bounds read vulnerability has been identified in libheif, a library for decoding and encoding HEIF and AVIF file formats. This vulnerability exists in versions 1.19.0 prior to 1.23.3, specifically in the no-icef full-item branch of the uncompressed decoder. The issue arises from an addition-based range check that can overflow when a crafted uncompressed tile grid produces a large range_start_offset and range_size. This overflow allows the bounds check to be bypassed, leading to an out-of-bounds read during tile processing, which can crash applications that decode HEIF tiles using libheif.
Users are advised to upgrade to libheif version 1.23.3, where this vulnerability has been fixed. The fix involves applying a subtraction-based range check to prevent the overflow, ensuring that the tile decoding process does not read beyond the allocated memory.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 18, 2026CISA-ADP
Assessed Sep 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/strukturag/libheif/commit/8bfed9a9ed008e4ef28abc736284a90d3cba754f | [email protected] | Source CodeVendor |
| https://github.com/strukturag/libheif/releases/tag/v1.23.3 | [email protected] | BundleRelease NotesVendor |
| https://github.com/strukturag/libheif/security/advisories/GHSA-hh47-fhqr-cj2r | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| libheif | >= 1.19.0, <= 1.23.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 24, 2026 | CVE Modified | CISA-ADP |
| Sep 18, 2026 | New CVE Received | [email protected] |