strukturag libheif up to 1.23.1 Region heif_regions.cc heif_region_item_add_region_inline_mask_data mask_data_len heap-based overflow

Summaryinfo

A vulnerability labeled as critical has been found in strukturag libheif up to 1.23.1. The affected element is the function heif_region_item_add_region_inline_mask_data of the file libheif/api/libheif/heif_regions.cc of the component Region Handler. Executing a manipulation of the argument mask_data_len can lead to heap-based overflow. This vulnerability appears as CVE-2026-84448. The attack may be performed from remote. There is no available exploit. The affected component should be upgraded.

Detailsinfo

A vulnerability has been found in strukturag libheif up to 1.23.1 and classified as critical. This vulnerability affects the function heif_region_item_add_region_inline_mask_data of the file libheif/api/libheif/heif_regions.cc of the component Region Handler. The manipulation of the argument mask_data_len with an unknown input leads to a heap-based overflow vulnerability. The CWE definition for the vulnerability is CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, the public heif_region_item_add_region_inline_mask_data() function in libheif/api/libheif/heif_regions.cc accepts mask_data_len without verifying that it equals the byte count required by width and height. A later heif_region_get_mask_image() call derives the read length from the region geometry, so an undersized stored buffer causes heif_region_get_inline_mask_image() to read beyond the heap allocation and copy adjacent bytes into the returned monochrome mask image. This can disclose heap data or crash an application that constructs region metadata through the writer API, while the file-parsing path is not affected because it validates the canonical mask size. This issue is fixed in version 1.23.2.

The advisory is available at github.com. This vulnerability was named CVE-2026-84448 since 09/01/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Technical details are known, but there is no available exploit.

Upgrading to version 1.23.2 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• strukturag

Name

• libheif

Version

• 1.23.0
• 1.23.1

Website

• Product: https://github.com/strukturag/libheif/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion