CVE-2026-84449 in libheif
Summary
by MITRE • 09/18/2026
libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.19.6, Op_RGB24_32_to_YCbCr::convert_colorspace() stores image-plane strides in an integer width that can overflow for extremely large RGB images created through heif_image_create() and heif_image_add_plane(). The resulting wrapped stride causes the conversion loop in libheif/color-conversion/rgb2yuv.cc to compute an invalid input pointer and read beyond the allocated interleaved plane while heif_context_encode_image() performs RGB-to-YCbCr conversion. This can crash the encoding process. This issue is fixed in version 1.19.6.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/18/2026
The vulnerability identified in libheib, a widely used library for decoding and encoding HEIF and AVIF image formats, represents a critical integer overflow flaw within its color space conversion routines. Specifically, the function Op_RGB24_32_to_YCbCr::convert_colorspace() is responsible for managing memory strides when converting RGB images to YCbCr format during the encoding process. In versions prior to 1.19.6, this routine stores image-plane stride values in integer variables that are insufficiently sized to handle extremely large dimensions generated via heif_image_create and heif_image_add_plane functions. When an attacker or a malicious input provides image parameters with excessively large width or height values, the calculated stride value exceeds the maximum limit of the signed 32-bit integer type used for storage. This overflow causes the stride variable to wrap around into negative territory or a significantly smaller positive number than intended, fundamentally corrupting the memory addressing logic required for safe pixel data access.
The operational impact of this flaw manifests as an out-of-bounds read during the execution of heif_context_encode_image(). As the conversion loop iterates through the image planes using the corrupted stride value, it computes invalid input pointers that point to memory locations outside the bounds of the allocated interleaved plane buffer. This results in a heap-based out-of-bounds read vulnerability, classified under CWE-125: Out-of-bounds Read. The immediate consequence is typically a segmentation fault or application crash, leading to a denial of service against any system relying on libheif for image processing. In more complex scenarios involving specific memory layouts and subsequent operations, such invalid reads could potentially leak sensitive information from adjacent memory regions if the process does not terminate immediately upon detecting an illegal access violation.
From a threat modeling perspective, this vulnerability aligns with ATT&CK technique T1499: Endpoint Denial of Service, as it allows for the disruption of service through resource exhaustion or application crashes. It also relates to CWE-787: Out-of-bounds Write if similar logic were applied in write operations, though here the primary risk is read-based data corruption and instability. The flaw highlights a common pitfall in C/C++ development where arithmetic operations on dimensions are not validated against integer limits before being used for memory allocation or pointer arithmetic. Attackers can exploit this by crafting HEIF or AVIF files with specific metadata that triggers heif_image_create with extreme parameters, thereby forcing the library into an unstable state during encoding tasks such as thumbnail generation, preview rendering, or batch processing pipelines.
Mitigation strategies primarily involve upgrading to libheif version 1.19.6 or later, where this integer overflow has been corrected by implementing proper bounds checking and using larger data types for stride calculations. For systems unable to upgrade immediately, defensive programming practices should be adopted at the integration layer. This includes validating all image dimensions provided by external sources before passing them to libheif functions, ensuring that width and height values fall within reasonable limits defined by application requirements rather than just theoretical maximums. Additionally, employing static analysis tools capable of detecting integer overflows in C/C++ codebases can help identify similar vulnerabilities in custom implementations or forks of the library. Regular security audits focusing on memory management routines are essential to prevent recurrence of such low-level arithmetic errors that compromise software stability and integrity.