CVE-2026-84449: libheif hOp_RGB24_32_to_YCbCr Memory Access Error / SEGV
libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.19.6, OpRGB2432toYCbCr::convertcolorspace() stores image-plane strides in an integer width that can overflow for extremely large RGB images created through heifimagecreate() and heifimageaddplane(). The resulting wrapped stride causes the conversion loop in libheif/color-conversion/rgb2yuv.cc to compute an invalid input pointer and read beyond the allocated interleaved plane while heifcontextencodeimage() performs RGB-to-YCbCr conversion. This can crash the encoding process. This issue is fixed in version 1.19.6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
libheifto a version that resolves this vulnerability.Fixed in 1.19.6
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Applications using libheif to create extremely large RGB images with heif_image_create() and heif_image_add_plane(), then passing them to heif_context_encode_image(), are exposed during RGB-to-YCbCr conversion. Decoding-only use is not described as affected.
What conditions are required to trigger the crash?
The RGB image dimensions and plane stride must be large enough to overflow the integer width used to store image-plane strides. The wrapped stride then causes conversion code to calculate an invalid input pointer and read past the allocated interleaved plane.
How can I remediate or reduce exposure?
Update libheif to version 1.19.6 or later. Until updating is possible, avoid encoding extremely large RGB images through the affected image-creation and encoding path, and enforce limits on image dimensions and plane sizes before calling those APIs.
How can I identify potentially affected systems?
Check whether the deployed libheif version is earlier than 1.19.6 and whether the application uses libheif for RGB image encoding. Affected executions may terminate during RGB-to-YCbCr conversion while heif_context_encode_image() is running.