CVE-2026-84444 libheif uncompressed tiled image encoding allows out-of-bounds write
An out-of-bounds write in libheif's uncompressed tiled image encoding allows attackers to execute arbitrary code when the uncompressed codec is enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-84444?
CVE-2026-84444 is a high-severity memory corruption vulnerability in strukturag libheif, published on 18 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, when WITH_UNCOMPRESSED_CODEC is enabled, heif_context_add_image_tile() accepts an independently constructed tile whose component-plane dimensions do not match the tile geometry established by the prototype image. ImageItem_uncompressed::add_image_tile() passes that tile directly to unc_encoder::encode_tile(), which lacked the check_component_sizes() gate and sizes its output from the configured tile geometry while copying the tile's actual component-plane dimensions. An oversized component plane can therefore make unc_encoder_component_interleave::encode_tile() copy attacker-controlled data beyond the heap output buffer. This issue is fixed in version 1.23.2.
Weakness: CWE-787
Which versions are affected by CVE-2026-84444?
How do I fix CVE-2026-84444?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-84444 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-84444 exists.
Sources
Also known as BELL-CVE-2026-84444, DEBIAN-CVE-2026-84444, ECHO-9fd0-a39b-9ef0, GHSA-j264-xvrp-5v7q, MINI-6vhc-mj8v-xw4c, ROOT-OS-DEBIAN-12-CVE-2026-84444.