strukturag libheif up to 1.23.1 Uncompressed Codec encode_tile heap-based overflow

Summaryinfo

A vulnerability, which was classified as critical, has been found in strukturag libheif up to 1.23.1. Affected by this vulnerability is the function unc_encoder_component_interleave::encode_tile of the component Uncompressed Codec. Performing a manipulation results in heap-based overflow. This vulnerability was named CVE-2026-84444. The attack may be initiated remotely. There is no available exploit. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical has been found in strukturag libheif up to 1.23.1. This affects the function unc_encoder_component_interleave::encode_tile of the component Uncompressed Codec. The manipulation with an unknown input leads to a heap-based overflow vulnerability. CWE is classifying the issue as CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). This is going to have an impact on integrity, and availability. The summary by CVE is:

libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, when WITH_UNCOMPRESSED_CODEC is enabled, heif_context_add_image_tile() accepts an independently constructed tile whose component-plane dimensions do not match the tile geometry established by the prototype image. ImageItem_uncompressed::add_image_tile() passes that tile directly to unc_encoder::encode_tile(), which lacked the check_component_sizes() gate and sizes its output from the configured tile geometry while copying the tile's actual component-plane dimensions. An oversized component plane can therefore make unc_encoder_component_interleave::encode_tile() copy attacker-controlled data beyond the heap output buffer. This issue is fixed in version 1.23.2.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-84444 since 09/01/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 1.23.2 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• strukturag

Name

• libheif

Version

• 1.23.0
• 1.23.1

Website

• Product: https://github.com/strukturag/libheif/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion