CVE-2026-84444High· 7.4▾ Twilightlibheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, when WITH_UNCOMPRESSED_CODEC is enabled, heif_context_add_image_tile() accepts an independently constructed tile whose component-plane dimensions do not match t…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 40.7 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 19.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.4%
libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, when WITH_UNCOMPRESSED_CODEC is enabled, heif_context_add_image_tile() accepts an independently constructed tile whose component-plane dimensions do not match the tile geometry established by the prototype image. ImageItem_uncompressed::add_image_tile() passes that tile directly to unc_encoder::encode_tile(), which lacked the check_component_sizes() gate and sizes its output from the configured tile geometry while copying the tile's actual component-plane dimensions. An oversized component plane can therefore make unc_encoder_component_interleave::encode_tile() copy attacker-controlled data beyond the heap output buffer. This issue is fixed in version 1.23.2.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-84383Critical· 9.8libheif is a HEIF and AVIF file format decoder and encoder
CVE-2026-84448Medium· 4.0libheif is a HEIF and AVIF file format decoder and encoder
CVE-2026-84447High· 7.5libheif is a HEIF and AVIF file format decoder and encoder
CVE-2026-84446High· 7.5libheif is a HEIF and AVIF file format decoder and encoder
CVE-2026-84384High· 7.5libheif is a HEIF and AVIF file format decoder and encoder
CVE-2026-84451Medium· 6.5libheif is a HEIF and AVIF file format decoder and encoder