CVE-2026-84444
published 2026-09-18CVE-2026-84444: libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, when WITH_UNCOMPRESSED_CODEC is enabled, heif_context_add_image_tile() accepts an…
PriorityP346high7.4CVSS 3.1
AVNACHPRNUINSUCNIHAH
EPSS
0.48%
39.8th percentile
libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, when WITH_UNCOMPRESSED_CODEC is enabled, heif_context_add_image_tile() accepts an independently constructed tile whose component-plane dimensions do not match the tile geometry established by the prototype image. ImageItem_uncompressed::add_image_tile() passes that tile directly to unc_encoder::encode_tile(), which lacked the check_component_sizes() gate and sizes its output from the configured tile geometry while copying the tile's actual component-plane dimensions. An oversized component plane can therefore make unc_encoder_component_interleave::encode_tile() copy attacker-controlled data beyond the heap output buffer. This issue is fixed in version 1.23.2.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| strukturag | libheif | < 1.23.2 | 1.23.2 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No advisories linked to this vulnerability.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-84444 libheif: libheif: Out-of-bounds write allows arbitrary code execution via crafted image tile [fedora-43]
bugzilla·2026-09-23·CVSS 7.4
CVE-2026-84444 [HIGH] CVE-2026-84444 libheif: libheif: Out-of-bounds write allows arbitrary code execution via crafted image tile [fedora-43]
CVE-2026-84444 libheif: libheif: Out-of-bounds write allows arbitrary code execution via crafted image tile [fedora-43]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, when WITH_UNCOMPRESSED_CODEC is enabled, heif_context_add_image_tile() accepts an independently constructed tile whose component-plane dimensions do not match the tile geometry established by the prototype image. ImageItem_uncompressed::add_image_tile() passes that tile directly to unc_encoder::encode_tile(), which lacked the check_component_sizes() gate and sizes its output
Bugzilla
CVE-2026-84444 libheif: libheif: Out-of-bounds write allows arbitrary code execution via crafted image tile [epel-all]
bugzilla·2026-09-23·CVSS 7.4
CVE-2026-84444 [HIGH] CVE-2026-84444 libheif: libheif: Out-of-bounds write allows arbitrary code execution via crafted image tile [epel-all]
CVE-2026-84444 libheif: libheif: Out-of-bounds write allows arbitrary code execution via crafted image tile [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, when WITH_UNCOMPRESSED_CODEC is enabled, heif_context_add_image_tile() accepts an independently constructed tile whose component-plane dimensions do not match the tile geometry established by the prototype image. ImageItem_uncompressed::add_image_tile() passes that tile directly to unc_encoder::encode_tile(), which lacked the check_component_sizes() gate and sizes its output
2026-09-18
Published