HEIF and AVIF File Format Vulnerability in libheif by Struktur AG

CVE-2026-84444

What is CVE-2026-84444?

The libheif library, which decodes and encodes HEIF and AVIF file formats, contains a vulnerability when the WITH_UNCOMPRESSED_CODEC feature is enabled. Specifically, the function heif_context_add_image_tile() allows a constructed tile to be accepted even if its component-plane dimensions do not align with the tile geometry defined by the prototype image. This oversight leads to the unc_encoder::encode_tile() function bypassing crucial checks, enabling an oversized component plane to potentially write data beyond the heap buffer. This substantial flaw was addressed in version 1.23.2, ensuring that dimensions are consistently matched.

References