CVE-2026-84448: libheif: Heap out-of-bounds read in libheif inline-mask region API (heif_region_item_add_region_inline_mask_data / heif_region_get_mask_image)
libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, the public heifregionitemaddregioninlinemaskdata() function in libheif/api/libheif/heifregions.cc accepts maskdatalen without verifying that it equals the byte count required by width and height. A later heifregiongetmaskimage() call derives the read length from the region geometry, so an undersized stored buffer causes heifregiongetinlinemaskimage() to read beyond the heap allocation and copy adjacent bytes into the returned monochrome mask image. This can disclose heap data or crash an application that constructs region metadata through the writer API, while the file-parsing path is not affected because it validates the canonical mask size. This issue is fixed in version 1.23.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
libheifto a version that resolves this vulnerability.Fixed in 1.23.2
Event History
Frequently Asked Questions
Are applications that only decode HEIF or AVIF files exposed?
No. The file-parsing path validates the canonical mask size and is not affected. The issue affects applications that construct region metadata through the writer API and later retrieve a mask image.
What conditions are required to trigger the out-of-bounds read?
An application must call heif_region_item_add_region_inline_mask_data() with mask data shorter than the byte count required by the supplied width and height, then call heif_region_get_mask_image(). The later call uses the region geometry to determine how much data to read.
What can happen if an application is affected?
The returned monochrome mask image can include adjacent heap bytes, which may disclose heap data. The out-of-bounds read can also crash the application.
What should teams do if they use the affected writer API?
Upgrade libheif to version 1.23.2. Until upgrading, ensure mask_data_len exactly matches the byte count required by the mask width and height before calling heif_region_item_add_region_inline_mask_data().
How can teams determine whether their integration is affected?
Review whether the application calls heif_region_item_add_region_inline_mask_data() and later calls heif_region_get_mask_image(). Integrations limited to parsing HEIF or AVIF files are not affected by this issue.