CVE-2026-84384: libheif: brotli/zlib decompression paths lack output-size limits, allowing decompression-bomb OOM/DoS
libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.2, crafted HEIF or AVIF mime metadata and unci image data can cause decompressbrotli() and doinflate() to grow accumulated output without an effective size limit or MemoryHandle accounting. The brotli path has no output bound, while the zlib path checks only a small temporary buffer in a branch that valid streams do not reach, and overlapping icef units can decompress the same payload repeatedly. HeifContext::interpretheiffileimages() processes multiple compressed metadata items during file opening, allowing a small file to consume unbounded memory and terminate the process. This issue is fixed in version 1.23.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
libheifto a version that resolves this vulnerability.Fixed in 1.23.2
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using libheif versions from 1.19.0 up to, but not including, 1.23.2 are affected when they process attacker-controlled HEIF or AVIF files. Exposure occurs during file opening, before image interpretation completes.
What does an attacker need to exploit it?
An attacker only needs to provide a crafted HEIF or AVIF file containing compressed MIME metadata or unci image data. No authentication or user interaction is required by the vulnerability vector, although the affected application must process the file.
What is the impact of successful exploitation?
A small crafted file can cause decompression output to grow without an effective memory limit. This can exhaust memory and terminate the process, resulting in a denial of service.
How can this be remediated?
Upgrade libheif to version 1.23.2, which fixes the issue. The supplied data does not identify a workaround for installations that cannot yet upgrade.