CVE-2026-84451: libheif: Incomplete fix for CVE-2026-62292 leaves libheif vulnerable to an out-of-bounds read
libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.3, the no-icef full-item branch of uncdecoder::getcompressedimagedatauncompressed() in libheif/codecs/uncompressed/uncdecoder.cc retains an addition-based range check that can wrap when a crafted uncompressed tile grid produces a large rangestartoffset and rangesize. The overflow makes the bounds comparison pass and allows heifimagehandledecodeimagetile() to call memcpy() with an invalid source pointer and a very large length when decoding a valid high-index advertised tile. This incomplete remediation of CVE-2026-62292 can reliably crash tile-processing applications, while whole-image decoding is not claimed to reach the demonstrated path. This issue is fixed in version 1.23.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
libheifto a version that resolves this vulnerability.Fixed in 1.23.3
Event History
Frequently Asked Questions
Which deployments are exposed?
Applications using libheif versions from 1.19.0 through versions before 1.23.3 are affected when they process uncompressed image tiles through the vulnerable tile-decoding path. The demonstrated impact is a reliable crash of tile-processing applications.
What does exploitation require?
An attacker needs to supply a crafted uncompressed tile grid that creates a large range_start_offset and range_size, then cause decoding of a valid high-index advertised tile. The CVSS vector indicates no attacker privileges are required, but user interaction is required.
Does whole-image decoding reach this issue?
Whole-image decoding is not claimed to reach the demonstrated vulnerable path. The described exposure is specifically associated with tile decoding via heif_image_handle_decode_image_tile().
How can this be remediated?
Upgrade libheif to version 1.23.3, which fixes the issue. The provided data does not identify a configuration-only workaround or other mitigation for systems that cannot yet upgrade.