CVE-2026-84451 libheif: Incomplete fix for CVE-2026-62292 leaves libheif vulnerable to an out-of-bounds read
An integer overflow in libheif allows attackers to cause a denial of service via crafted uncompressed tile grids, requiring an upgrade to the latest version.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-84451?
CVE-2026-84451 is a medium-severity vulnerability in strukturag libheif, published on 18 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.3, the no-icef full-item branch of unc_decoder::get_compressed_image_data_uncompressed() in libheif/codecs/uncompressed/unc_decoder.cc retains an addition-based range check that can wrap when a crafted uncompressed tile grid produces a large range_start_offset and range_size. The overflow makes the bounds comparison pass and allows heif_image_handle_decode_image_tile() to call memcpy() with an invalid source pointer and a very large length when decoding a valid high-index advertised tile. This incomplete remediation of CVE-2026-62292 can reliably crash tile-processing applications, while whole-image decoding is not claimed to reach the demonstrated path. This issue is fixed in version 1.23.3.
Weakness: CWE-125
Which versions are affected by CVE-2026-84451?
How do I fix CVE-2026-84451?
Upgrade to a fixed version.
Is CVE-2026-84451 being exploited?
There is no known exploitation of CVE-2026-84451 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-84451, DEBIAN-CVE-2026-84451, ECHO-b83b-0aa6-1414, GHSA-hh47-fhqr-cj2r, MINI-rcf5-9mpp-8976.