CVE-2026-84384

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-84384
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-84384.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-84384
Aliases
  • GHSA-24wx-9w62-c96w
Downstream
Related
Published
2026-09-18T15:58:21Z
Modified
2026-09-20T14:16:32Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
libheif: brotli/zlib decompression paths lack output-size limits, allowing decompression-bomb OOM/DoS
Details

libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.2, crafted HEIF or AVIF mime metadata and unci image data can cause decompress_brotli() and do_inflate() to grow accumulated output without an effective size limit or MemoryHandle accounting. The brotli path has no output bound, while the zlib path checks only a small temporary buffer in a branch that valid streams do not reach, and overlapping icef units can decompress the same payload repeatedly. HeifContext::interpret_heif_file_images() processes multiple compressed metadata items during file opening, allowing a small file to consume unbounded memory and terminate the process. This issue is fixed in version 1.23.2.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-409"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84384.json"
}
References

Affected packages

Git / github.com/strukturag/libheif

Affected ranges

Type
GIT
Repo
https://github.com/strukturag/libheif
Events
Introduced
c4e4657dcf6bcc06e934632f97736f7c78dbff9e
Fixed
21893e8f66c8b79363ca2809391b07d35e1a95ec
Fixed
ac1cb05c39008f01525c991ff8b88f84ddf70fd2
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "1.19.0"
        },
        {
            "fixed": "1.23.2"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v1.*
v1.19.0
v1.19.1
v1.19.2
v1.19.3
v1.19.4
v1.19.5
v1.20.0
v1.20.1
v1.21.0
v1.21.1
v1.21.2
v1.22.0
v1.22.1
v1.22.2
v1.23.0
v1.23.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-84384.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "76319474047752418403516485028569914786",
            "length": 1847
        },
        "id": "CVE-2026-84384-1cb4ce12",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/strukturag/libheif/commit/21893e8f66c8b79363ca2809391b07d35e1a95ec",
        "target": {
            "file": "libheif/file.cc",
            "function": "HeifFile::get_item_data"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "157487306107788039413161003148305390417",
            "length": 2705
        },
        "id": "CVE-2026-84384-203dab2c",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/strukturag/libheif/commit/21893e8f66c8b79363ca2809391b07d35e1a95ec",
        "target": {
            "file": "libheif/codecs/uncompressed/unc_decoder.cc",
            "function": "unc_decoder::get_compressed_image_data_uncompressed"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "67613014183781584501770202586658673229",
                "250335245901152038044825155522604465396",
                "310253159301865349404344107415074766740",
                "274960629925950967920478328760518902893"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-84384-6490cf19",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/strukturag/libheif/commit/21893e8f66c8b79363ca2809391b07d35e1a95ec",
        "target": {
            "file": "libheif/image-items/image_item.h"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "116427440774047655530186421366971630384",
            "length": 1410
        },
        "id": "CVE-2026-84384-6b0ac003",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/strukturag/libheif/commit/21893e8f66c8b79363ca2809391b07d35e1a95ec",
        "target": {
            "file": "libheif/codecs/uncompressed/unc_decoder.cc",
            "function": "unc_decoder::do_decompress_data"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "232900574190866604432635952182809959685",
            "length": 71
        },
        "id": "CVE-2026-84384-6c7adc0c",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/strukturag/libheif/commit/21893e8f66c8b79363ca2809391b07d35e1a95ec",
        "target": {
            "file": "libheif/compression_zlib.cc",
            "function": "decompress_deflate"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "108714083514808708531797433942375872323",
            "length": 1925
        },
        "id": "CVE-2026-84384-6f67566d",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/strukturag/libheif/commit/21893e8f66c8b79363ca2809391b07d35e1a95ec",
        "target": {
            "file": "libheif/file.cc",
            "function": "HeifFile::get_uncompressed_item_data"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "31491800956507819973699993212958769776",
            "length": 1735
        },
        "id": "CVE-2026-84384-760ffe3e",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/strukturag/libheif/commit/21893e8f66c8b79363ca2809391b07d35e1a95ec",
        "target": {
            "file": "libheif/compression_brotli.cc",
            "function": "decompress_brotli"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "337402698982522818768453115248452863716",
                "273775045201093665226557054864314069640",
                "287377512904220069896472281021097624143",
                "297544454543402510203489696669555160184",
                "15069477689261345667400147023019975597",
                "20035599782285024717854390321030970296",
                "298299755873733723477005602968197832760",
                "249680172299540367038446860534504167377",
                "114372901442482635838059243550729732452",
                "150079470882635811367143049767793890685",
                "181815700386325355395553043185526388302",
                "213802047352939133477196066926993532367",
                "23825981181024632833672640522979877744",
                "40216684338580870932498236331324866000",
                "119487746908761162460828546010798315912",
                "69475075158187828021872891792035399669",
                "181593633110790192620034027550031603256",
                "44725713610634506373779350088493585497",
                "223391456085911267021515634294861491301",
                "174152704098606491845852808853158609560",
                "217628837151404931703445508086217565718",
                "298299755873733723477005602968197832760",
                "134899813883387261116883352291183875923",
                "67520979377441854834467742947003215064",
                "108327688421988283887026939215244119264",
                "125485550392019319816979450162878576500",
                "43678643956367090506081948023323536508",
                "191248947384141395607809668367035084758",
                "365334167329997286599295851142841929",
                "162419962074931260072064198811449245239",
                "249739091443343102097661046190743113105",
                "93153716994463743244402348575584435946",
                "163504636877760457645966891912032254471",
                "175879163039549560051120449782228456159",
                "159657351310710891549154283579310839963",
                "113850013374679273458807996757684384582",
                "97028600989716920936579207450492001873",
                "75690279627393813637986443606471178296"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-84384-7cc6457e",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/strukturag/libheif/commit/21893e8f66c8b79363ca2809391b07d35e1a95ec",
        "target": {
            "file": "libheif/codecs/uncompressed/unc_decoder.cc"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "56754112790514173136872006025853258199",
            "length": 15718
        },
        "id": "CVE-2026-84384-95a4d1d0",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/strukturag/libheif/commit/21893e8f66c8b79363ca2809391b07d35e1a95ec",
        "target": {
            "file": "libheif/context.cc",
            "function": "HeifContext::interpret_heif_file_images"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "34367767670864833874847156409340337901",
                "217237620462167488836337582636688780039",
                "264702505090844438538855330142505650041",
                "4081605575643262922617498712234210930",
                "56378817574695983279229405544665155832",
                "220876429105524296929740067030179017613",
                "243221816845614659971105475287072329648",
                "84390917551752403837319818295656212317",
                "26160608127328058830628093747624850282",
                "73934482114016240680590812263469326591",
                "27133021653873699984994797190466484399"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-84384-a5633d67",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/strukturag/libheif/commit/21893e8f66c8b79363ca2809391b07d35e1a95ec",
        "target": {
            "file": "libheif/compression.h"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "305484370907664425080354742460615680372",
            "length": 69
        },
        "id": "CVE-2026-84384-acbb4a70",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/strukturag/libheif/commit/21893e8f66c8b79363ca2809391b07d35e1a95ec",
        "target": {
            "file": "libheif/compression_zlib.cc",
            "function": "decompress_zlib"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "56633359397732090284360419082828317853",
                "113917885697261490758623136371895073471",
                "26926703758000121292570172662255793698",
                "207279526463415765513095624115119658185",
                "80584985660372658371162712480255138078",
                "128145350354670123684099635473978014500",
                "290909776618929512577480918715254824844",
                "120917120930146469653016620474127638470",
                "29590031730219084293399765212105896777",
                "329120162372519494320945668576641555202",
                "185912450964000104734291591993959301314",
                "78889347051903908770529051532741356017",
                "17302914435229375252637695525132305150",
                "307433333012001257823625797541665806867",
                "197951611354939188619656272373984470638",
                "195268534000002981543246511534195397128",
                "79134842032670611708331584177307544952",
                "16753696803545996691318713103166583443",
                "305695557920121151030007766708584424467",
                "82412138421504323595298602565149225122"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-84384-bea9f67f",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/strukturag/libheif/commit/21893e8f66c8b79363ca2809391b07d35e1a95ec",
        "target": {
            "file": "libheif/compression_brotli.cc"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "174779380109463199981668636194346742712",
            "length": 1967
        },
        "id": "CVE-2026-84384-d329d383",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/strukturag/libheif/commit/21893e8f66c8b79363ca2809391b07d35e1a95ec",
        "target": {
            "file": "libheif/compression_zlib.cc",
            "function": "do_inflate"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "41499496420030047762939737410179024888",
                "3144515627737410214705377070098463280",
                "132882009999885968516708350479917912099",
                "162572599483684077189218633004986658989"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-84384-d816ddc4",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/strukturag/libheif/commit/21893e8f66c8b79363ca2809391b07d35e1a95ec",
        "target": {
            "file": "libheif/codecs/uncompressed/unc_decoder.h"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "194174037093362768281887988035780120886",
                "170534565249925808084737358741287442445",
                "56424246243151345623585111402814895572",
                "59680588937106104654512445389649371644"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-84384-d8a4313d",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/strukturag/libheif/commit/21893e8f66c8b79363ca2809391b07d35e1a95ec",
        "target": {
            "file": "libheif/context.cc"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "321884876527659878453632393318018429327",
                "208516103718532913729907312089601221505",
                "43261018444412162499039032357204834968",
                "140307766128979326278636661303818969912",
                "247347350494689641973538122890027956318",
                "6081866251548643854058675499972505677",
                "190415419445697362695206897638186262925",
                "334781311975289627347335311435025848418",
                "324910730284412701234337428909790765446",
                "305877429759581964513361562091040226173",
                "61015162469856807133065190105603282597",
                "400948088925955245051530216936928700",
                "102031103673957207890626172605644638517",
                "49137096744071211295844807374800575604",
                "37170190737741486915871524781023153384",
                "325746603234512167377051217077656319249",
                "18417741473044885913007272712877028655",
                "108856610248609002459896637878892641140",
                "10560604116210529127196989558725159773",
                "334261172051837620603840851544174590117",
                "154097542018695866033101368047789899624",
                "74084142435965959220404623179097825389"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-84384-efb5ffaf",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/strukturag/libheif/commit/21893e8f66c8b79363ca2809391b07d35e1a95ec",
        "target": {
            "file": "libheif/file.cc"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "192583725307888656787493191939659285412",
                "100387613394044457986217241968684262300",
                "8455801287648116889561699780420987078",
                "90506980881719590667946372611257095202",
                "140841000204803010165999255181227914769",
                "63369095029931743387167918574699224433",
                "40853485958087138831670755937271100294",
                "126092809406888188784120322840405461514",
                "16546558141616639975466249061485520675",
                "114585454184288325358047881711929297264",
                "22160405262411783023380412721346806357",
                "244008003071627591075986437024645907806",
                "173578189810179671589217659364730843637",
                "125247897113510992309745811075729340424",
                "76198025063292779618117795543755945422",
                "88114433368126113463320845870531982050",
                "37961613276371805624558830968388063167",
                "78394615551833063442787100610146501459",
                "317106303635899368297455486043027105092",
                "244424265050937673216830621407705466874",
                "157581483560846810531345074682577806633",
                "145529324427143092859004434859023205520",
                "320304633085637361705079251779363908248",
                "18855153004064713215424539060863149333",
                "277457163625021986485434163887976858251",
                "95454790370299956339297307348399473624",
                "154504451012395969699053992900600780882",
                "237095330130171702761982475066526707509",
                "136778505823142492993041307666479527497",
                "12326152920251121979396505480149292150",
                "165443121162123182062691249283232367694"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-84384-fb1999bd",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/strukturag/libheif/commit/21893e8f66c8b79363ca2809391b07d35e1a95ec",
        "target": {
            "file": "libheif/compression_zlib.cc"
        }
    }
]
vanir_signatures_modified 
"2026-09-20T14:16:32Z"