CVE-2026-84383: libheif: Heap buffer overflow in `scale_nearest_neighbor()` via duplicate Alpha planes from nested `iden`/`auxl` items
libheif is a HEIF and AVIF file format decoder and encoder. From 1.22.0 until 1.23.2, a crafted HEIF, HEIC, or AVIF item graph using nested iden and auxl references can make HeifPixelImage::transferchannelfromimageas() append duplicate Alpha planes with different bit depths to mstorage. HeifPixelImage::scalenearestneighbor() in libheif/image/pixelimage.cc allocates the destination Alpha plane using the first plane's 8-bit depth, then iterates a later 10-bit or 12-bit Alpha component and writes uint16t samples into the same 8-bit allocation. The output geometry controls the overflow extent and the encoded sample values control the data written, allowing a remote file processed by heifdecodeimage() to cause a heap out-of-bounds write. This issue is fixed in version 1.23.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
libheifto a version that resolves this vulnerability.Fixed in 1.23.2
Event History
Frequently Asked Questions
Which deployments are exposed?
Applications using libheif versions 1.22.0 through 1.23.1 are affected when they process attacker-controlled HEIF, HEIC, or AVIF files through heif_decode_image().
What does an attacker need to exploit this issue?
The attacker needs to supply a crafted image containing nested iden and auxl references that produce duplicate Alpha planes with different bit depths. No authentication or user interaction is required according to the provided severity vector.
What is the impact of processing a malicious file?
The crafted image can cause a heap out-of-bounds write during nearest-neighbor scaling. The output geometry controls the overflow extent, and encoded sample values control the data written.
How should this be remediated?
Upgrade libheif to version 1.23.2, which fixes the issue. If upgrading cannot happen immediately, avoid processing untrusted HEIF, HEIC, and AVIF files with affected libheif versions.