Skip to content
OpenAdvisories
High · 7.4 CVE-2026-84444 EUVD-2026-83020

libheif uncompressed tiled image encoding allows out-of-bounds write

Published Sep 18, 2026 · Updated Sep 22, 2026 · Assigned by GitHub_M

Description

libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, when WITH_UNCOMPRESSED_CODEC is enabled, heif_context_add_image_tile() accepts an independently constructed tile whose component-plane dimensions do not match the tile geometry established by the prototype image. ImageItem_uncompressed::add_image_tile() passes that tile directly to unc_encoder::encode_tile(), which lacked the check_component_sizes() gate and sizes its output from the configured tile geometry while copying the tile's actual component-plane dimensions. An oversized component plane can therefore make unc_encoder_component_interleave::encode_tile() copy attacker-controlled data beyond the heap output buffer. This issue is fixed in version 1.23.2.

Affected products

VendorProductAffectedFixed
strukturag libheif < 1.23.2 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 libheif 1.23.2-1 —
Debian 13 libheif 1.23.4-1~deb13u1 —
Debian 12 libheif No fix yet —
ReleasePackageFixed inAdvisory
SLES 15 SP7 libheif 1.23.4-150700.3.21.1 SUSE-SU-2026:4276-1
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed libheif 1.23.4-1.1 openSUSE-SU-2026:11719-1
openSUSE Leap 16.0 libheif 1.23.4-160000.1.1 openSUSE-SU-2026:21889-1

Advisories 3

References