CVE-2026-84451Medium· 6.5▾ Sunlitlibheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.3, the no-icef full-item branch of unc_decoder::get_compressed_image_data_uncompressed() in libheif/codecs/uncompressed/unc_decoder.cc retains an addition…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 19.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.4%
libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.3, the no-icef full-item branch of unc_decoder::get_compressed_image_data_uncompressed() in libheif/codecs/uncompressed/unc_decoder.cc retains an addition-based range check that can wrap when a crafted uncompressed tile grid produces a large range_start_offset and range_size. The overflow makes the bounds comparison pass and allows heif_image_handle_decode_image_tile() to call memcpy() with an invalid source pointer and a very large length when decoding a valid high-index advertised tile. This incomplete remediation of CVE-2026-62292 can reliably crash tile-processing applications, while whole-image decoding is not claimed to reach the demonstrated path. This issue is fixed in version 1.23.3.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-84448Medium· 4.0libheif is a HEIF and AVIF file format decoder and encoder
CVE-2026-84449Low· 3.7libheif is a HEIF and AVIF file format decoder and encoder
CVE-2026-84450Medium· 4.3libheif is a HEIF and AVIF file format decoder and encoder
CVE-2026-41071High· 8.1libheif is a HEIF and AVIF file format decoder and encoder
CVE-2026-41069Medium· 6.5libheif is a HEIF and AVIF file format decoder and encoder
CVE-2026-84444High· 7.4libheif is a HEIF and AVIF file format decoder and encoder