Memory Corruption Vulnerability in libheif HEIF and AVIF Format Decoder by Struktur AG
CVE-2026-84451

6.5MEDIUM

Key Information:

Vendor

Strukturag

Status
Libheif
Vendor
CVE Published:
18 September 2026

What is CVE-2026-84451?

The libheif library, responsible for decoding and encoding HEIF and AVIF file formats, contains a memory corruption flaw in its unc_decoder component. This issue, present in versions from 1.19.0 to 1.23.3, occurs due to an inadequate range check within the method responsible for processing uncompressed image data. Crafting specific input can exploit this flaw, leading to out-of-bounds memory access during tile decoding and potentially causing applications to crash. This vulnerability is compounded by incomplete remediation of a previous issue. The flaw has been addressed in version 1.23.3.

Affected Version(s)

libheif >= 1.19.0, < 1.23.3

References

https://github.com/strukturag/libheif/security/advisories...
x_refsource_CONFIRM
https://github.com/strukturag/libheif/commit/8bfed9a9ed00...
x_refsource_MISC
https://github.com/strukturag/libheif/releases/tag/v1.23.3
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.