CVE-2026-84447: libheif: Derived-image indirect reference chains and tiled offsets bypass decode caching and MemoryHandle limits, causing CPU/memory amplification DoS
libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.1 and earlier, crafted grid, iovl, and iden reference graphs can repeatedly decode the same base image because processedids is copied per branch and ImageItem::decodeimage() has no shared operation budget. This vulnerability is fixed in 1.23.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
libheifto a version that resolves this vulnerability.Fixed in 1.23.2
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using libheif version 1.23.1 or earlier to decode HEIF or AVIF content are affected. The issue is triggered during decoding of crafted derived-image reference graphs.
Does exploitation require authentication or user interaction?
No. The supplied vector is AV:N/AC:L/PR:N/UI:N, indicating that exploitation can be performed remotely with low complexity, without privileges or user interaction.
What is the impact of a successful exploit?
A crafted file can cause repeated decoding of the same base image, bypassing decode caching and MemoryHandle limits. This amplifies CPU and memory consumption and can result in denial of service; the provided vector indicates availability impact only.
What version fixes the issue?
The vulnerability is fixed in libheif 1.23.2. Upgrading from version 1.23.1 or earlier removes the affected behavior.