Memory Consumption Vulnerability in libheif Product by strukturag
CVE-2026-84384
What is CVE-2026-84384?
The libheif library, responsible for decoding and encoding HEIF and AVIF file formats, contains a memory consumption vulnerability that affects versions 1.19.0 to 1.23.1. Attackers can exploit this vulnerability by crafting specific HEIF or AVIF mime metadata, allowing a small file to generate unbounded memory usage during decompression operations. Both decompress_brotli() and do_inflate() functions can be triggered to grow the output size without constraints, leading to potential denial of service through process termination. The vulnerability arises from the handling of multiple compressed metadata items within the HeifContext::interpret_heif_file_images() function. This issue has been resolved in version 1.23.2.
Affected Version(s)
libheif >= 1.19.0, < 1.23.2