Heap Overflow Vulnerability in libheif Affects Image Encoding

CVE-2026-84449

What is CVE-2026-84449?

libheif, a decoder and encoder for HEIF and AVIF file formats, contains a vulnerability that occurs prior to version 1.19.6. The issue arises in the method Op_RGB24_32_to_YCbCr::convert_colorspace(), where the storage of image-plane strides can overflow for very large RGB images. When using functions like heif_image_create() and heif_image_add_plane(), the resultant wrapped stride may lead to the conversion loop attempting to access memory beyond the allocated interleaved plane. This could potentially result in a crash during the encoding process, posing a significant risk for users relying on this library for image processing tasks.

References