CVE-2026-84447

Published: Sep 18, 2026Modified: Sep 18, 2026Deferred

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: security-advisories@github.com (Secondary)

Description

libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.1 and earlier, crafted grid, iovl, and iden reference graphs can repeatedly decode the same base image because processed_ids is copied per branch and ImageItem::decode_image() has no shared operation budget. This vulnerability is fixed in 1.23.2.

Related CWEs

CWE-770

Allocation of Resources Without Limits or Throttling

The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

References (4)

https://github.com/strukturag/libheif/commit/30b52a4e829efe0ee6d7208e8500b99f664af5e9

Source: security-advisories@github.com

https://github.com/strukturag/libheif/releases/tag/v1.23.2

Source: security-advisories@github.com

https://github.com/strukturag/libheif/security/advisories/GHSA-x8xm-cm2c-cfc8

Source: security-advisories@github.com

https://github.com/strukturag/libheif/security/advisories/GHSA-x8xm-cm2c-cfc8

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.