Vulnerability · Published Sep 18, 2026 · Assigned by GitHub_M
CVE-2026-84451libheif: Incomplete fix for CVE-2026-62292 leaves libheif vulnerable to an out-of-bounds read
Medium 6.5
In plain English
A medium-severity out-of-bounds read in libheif from strukturag. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.3, the no-icef full-item branch of unc_decoder::get_compressed_image_data_uncompressed() in libheif/codecs/uncompressed/unc_decoder.cc retains an addition-based range check that can wrap when a crafted uncompressed tile grid produces a large range_start_offset and range_size. The overflow makes the bounds comparison pass and allows heif_image_handle_decode_image_tile() to call memcpy() with an invalid source pointer and a very large length when decoding a valid high-index advertised tile. This incomplete remediation of CVE-2026-62292 can reliably crash tile-processing applications, while whole-image decoding is not claimed to reach the demonstrated path. This issue is fixed in version 1.23.3.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | libheif | no fix listed | DEBIAN-CVE-2026-84451 |
| Debian:13 | libheif | 1.23.4-1~deb13u1 | DEBIAN-CVE-2026-84451 |
| Debian:14 | libheif | 1.23.3-1 | DEBIAN-CVE-2026-84451 |
| Ubuntu:24.04:LTS | libheif | no fix listed | UBUNTU-CVE-2026-84451 |
| Ubuntu:26.04:LTS | libheif | no fix listed | UBUNTU-CVE-2026-84451 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| strukturag | libheif | >= 1.19.0, < 1.23.3 |
Weakness: CWE-125 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H