Heap Buffer Overflow in libheif Affects Image Processing Applications

CVE-2026-84448

What is CVE-2026-84448?

The vulnerability in libheif arises from the public function heif_region_item_add_region_inline_mask_data(), which processes mask data length without sufficient verification against the expected byte count defined by image dimensions. This oversight allows heif_region_get_mask_image() to read beyond allocated heap memory, potentially exposing sensitive data or leading to application crashes when utilizing the writer API to construct region metadata. Users should update to version 1.23.2 where this issue has been addressed, ensuring secure use of the HEIF and AVIF file formats.

References