CVE-2026-84444

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-84444
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-84444.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-84444
Aliases
  • GHSA-j264-xvrp-5v7q
Downstream
Related
Published
2026-09-18T15:56:41Z
Modified
2026-09-20T14:16:31Z
Severity
  • 7.4 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H CVSS Calculator
Summary
libheif uncompressed tiled image encoding allows out-of-bounds write
Details

libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, when WITH_UNCOMPRESSED_CODEC is enabled, heif_context_add_image_tile() accepts an independently constructed tile whose component-plane dimensions do not match the tile geometry established by the prototype image. ImageItem_uncompressed::add_image_tile() passes that tile directly to unc_encoder::encode_tile(), which lacked the check_component_sizes() gate and sizes its output from the configured tile geometry while copying the tile's actual component-plane dimensions. An oversized component plane can therefore make unc_encoder_component_interleave::encode_tile() copy attacker-controlled data beyond the heap output buffer. This issue is fixed in version 1.23.2.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-787"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84444.json"
}
References

Affected packages

Git / github.com/strukturag/libheif

Affected ranges

Type
GIT
Repo
https://github.com/strukturag/libheif
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
e65071f59a1ac08aa1eb0d07a831deaf6bb4d03b
Fixed
ac1cb05c39008f01525c991ff8b88f84ddf70fd2
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.23.2"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v1.*
v1.1.0
v1.10.0
v1.11.0
v1.12.0
v1.13.0
v1.14.0
v1.14.1
v1.14.2
v1.15.0
v1.15.1
v1.15.2
v1.16.0
v1.16.1
v1.16.2
v1.17.0
v1.17.1
v1.17.2
v1.17.3
v1.17.4
v1.17.5
v1.17.6
v1.18.0
v1.18.0-rc1
v1.19.0
v1.19.1
v1.19.2
v1.19.3
v1.19.4
v1.19.5
v1.2.0
v1.20.0
v1.20.1
v1.21.0
v1.21.1
v1.21.2
v1.22.0
v1.22.1
v1.22.2
v1.23.0
v1.23.1
v1.3.0
v1.3.1
v1.3.2
v1.7.0
v1.8.0
v1.9.0
v1.9.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-84444.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "21746799924861355163437522053638053791",
            "length": 553
        },
        "id": "CVE-2026-84444-015aeed2",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/strukturag/libheif/commit/e65071f59a1ac08aa1eb0d07a831deaf6bb4d03b",
        "target": {
            "file": "libheif/codecs/uncompressed/unc_encoder_rgb_pixel_interleave.cc",
            "function": "unc_encoder_rgb_pixel_interleave::encode_tile"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "339053753553694708719272824858320798558",
            "length": 1374
        },
        "id": "CVE-2026-84444-0d1898cc",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/strukturag/libheif/commit/e65071f59a1ac08aa1eb0d07a831deaf6bb4d03b",
        "target": {
            "file": "libheif/codecs/uncompressed/unc_encoder_component_interleave.cc",
            "function": "unc_encoder_component_interleave::encode_tile"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "272508509191830491342494097314539974518",
                "235516039192449299655073584868728377238",
                "180255066410459710284475010498850818582",
                "53453415080009535891701420818251941128"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-84444-1301af13",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/strukturag/libheif/commit/e65071f59a1ac08aa1eb0d07a831deaf6bb4d03b",
        "target": {
            "file": "libheif/codecs/uncompressed/unc_encoder_rgb_block_pixel_interleave.h"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "252496850934115909011917543035431079937",
                "285213048824327950360827763969006111810",
                "128066993627106190106369174577076814780",
                "192407410311491770485233329107571673709"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-84444-18117956",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/strukturag/libheif/commit/e65071f59a1ac08aa1eb0d07a831deaf6bb4d03b",
        "target": {
            "file": "libheif/codecs/uncompressed/unc_encoder_rgb_pixel_interleave.cc"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "54456283306235187668712273853588813052",
            "length": 1631
        },
        "id": "CVE-2026-84444-36f56170",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/strukturag/libheif/commit/e65071f59a1ac08aa1eb0d07a831deaf6bb4d03b",
        "target": {
            "file": "libheif/image-items/unc_image.cc",
            "function": "ImageItem_uncompressed::add_image_tile"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "277510542258743573843713935664483449148",
                "325361898010874525974302550750320084045",
                "157810602971243530690075955855225716739",
                "172913901896238774105002555084028970686"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-84444-398cee4d",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/strukturag/libheif/commit/e65071f59a1ac08aa1eb0d07a831deaf6bb4d03b",
        "target": {
            "file": "libheif/codecs/uncompressed/unc_encoder_component_interleave.cc"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "282744426550898960184023324375774353057",
                "235516039192449299655073584868728377238",
                "60862148676925708000053116504191937936",
                "299917853079934832457454054394982525605"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-84444-54c331b9",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/strukturag/libheif/commit/e65071f59a1ac08aa1eb0d07a831deaf6bb4d03b",
        "target": {
            "file": "libheif/codecs/uncompressed/unc_encoder_component_interleave.h"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "51671866959765109462479787443437198413",
                "235458970753796469972344410901568343968",
                "122259460503554911389944695346544209947"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-84444-6479836a",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/strukturag/libheif/commit/e65071f59a1ac08aa1eb0d07a831deaf6bb4d03b",
        "target": {
            "file": "libheif/image-items/unc_image.cc"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "98230121587451678300642081428586097515",
            "length": 804
        },
        "id": "CVE-2026-84444-71f0c24d",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/strukturag/libheif/commit/e65071f59a1ac08aa1eb0d07a831deaf6bb4d03b",
        "target": {
            "file": "libheif/codecs/uncompressed/unc_encoder.cc",
            "function": "unc_encoder::check_component_sizes"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "327584256131400416990283458639637735342",
                "150521944305682235156197095707827601555",
                "132173395448906562778867830395947441583",
                "37595243237851887872946052818262973764"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-84444-7290276f",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/strukturag/libheif/commit/e65071f59a1ac08aa1eb0d07a831deaf6bb4d03b",
        "target": {
            "file": "libheif/codecs/uncompressed/unc_encoder_rgb_bytealign_pixel_interleave.cc"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "147265845980681057220894443382109274415",
                "121729813977482933843265342035197979585",
                "98780181033568596274007457729365626509",
                "16926201035863103934764882457658646320",
                "223688294277509300805514948488429825761",
                "20316594947244329398420210372722577656",
                "187881254747437409832609240900622487906",
                "175664231501580699883407099769528893196",
                "85864490079226284276775000077592155984",
                "66606399785682967105002416499382955010",
                "217285423227910428507329040730804783835",
                "151130156779126251866507075838571914127",
                "318028540634824965530598004759562385812",
                "121543116200292864115042410266393940493",
                "24088311608785076088563676821181554303",
                "267091972954580097690229634695243789239",
                "171490079832720437849107268556565816027",
                "89800332491236188370761476035543885107",
                "184479302279232768650820080103922531901",
                "225830844949296922491642008429314490213",
                "28593658212750657339482885315906225112",
                "42298573558624629541191320980828036068",
                "191968164562695690412176409160265944258"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-84444-87953dec",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/strukturag/libheif/commit/e65071f59a1ac08aa1eb0d07a831deaf6bb4d03b",
        "target": {
            "file": "libheif/codecs/uncompressed/unc_encoder.cc"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "234824126970031566612024301970550181828",
                "235516039192449299655073584868728377238",
                "180255066410459710284475010498850818582",
                "124427104851535784840879970951635803245"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-84444-89a46f43",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/strukturag/libheif/commit/e65071f59a1ac08aa1eb0d07a831deaf6bb4d03b",
        "target": {
            "file": "libheif/codecs/uncompressed/unc_encoder_rgb_bytealign_pixel_interleave.h"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "180168724888657706329481143524143646066",
            "length": 1205
        },
        "id": "CVE-2026-84444-a120abb6",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/strukturag/libheif/commit/e65071f59a1ac08aa1eb0d07a831deaf6bb4d03b",
        "target": {
            "file": "libheif/codecs/uncompressed/unc_encoder_rgb_block_pixel_interleave.cc",
            "function": "unc_encoder_rgb_block_pixel_interleave::encode_tile"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "158576073809515518585411567890328240680",
                "235516039192449299655073584868728377238",
                "180255066410459710284475010498850818582",
                "53453415080009535891701420818251941128"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-84444-b3843b1b",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/strukturag/libheif/commit/e65071f59a1ac08aa1eb0d07a831deaf6bb4d03b",
        "target": {
            "file": "libheif/codecs/uncompressed/unc_encoder_rgb_pixel_interleave.h"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "129658024547413652388017973774020297612",
            "length": 2016
        },
        "id": "CVE-2026-84444-bb89deee",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/strukturag/libheif/commit/e65071f59a1ac08aa1eb0d07a831deaf6bb4d03b",
        "target": {
            "file": "libheif/codecs/uncompressed/unc_encoder.cc",
            "function": "unc_encoder::unc_encoder"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "149996418315585050558591882635503094058",
            "length": 743
        },
        "id": "CVE-2026-84444-dc1e9f43",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/strukturag/libheif/commit/e65071f59a1ac08aa1eb0d07a831deaf6bb4d03b",
        "target": {
            "file": "libheif/codecs/uncompressed/unc_encoder_rgb_bytealign_pixel_interleave.cc",
            "function": "unc_encoder_rgb_bytealign_pixel_interleave::encode_tile"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "270345007932426470533034664082651900722",
                "311700578842240251868353410178576378338",
                "331989777216935185759196951906977560780",
                "191721132049715985171885550116790556439",
                "144278405828839306803258310250053106876",
                "71553457533013616915977835562773638678",
                "40809518408798403491006018595191109935",
                "297546825929376579915121987660649533244",
                "222850253593506205791767872186297163188",
                "160408518410720507288913800282687322535",
                "17361388898286060216254406706865230516",
                "170098999886335993737446375501868117212"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-84444-e5c4ef1d",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/strukturag/libheif/commit/e65071f59a1ac08aa1eb0d07a831deaf6bb4d03b",
        "target": {
            "file": "libheif/codecs/uncompressed/unc_encoder.h"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "294041675119103317862599308653451881740",
                "209501904055638032333384381978771569575",
                "243024793596170121834922607182188516874",
                "62219823176585999309586482750604416674"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-84444-ebc999e4",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/strukturag/libheif/commit/e65071f59a1ac08aa1eb0d07a831deaf6bb4d03b",
        "target": {
            "file": "libheif/codecs/uncompressed/unc_encoder_rgb_block_pixel_interleave.cc"
        }
    }
]
vanir_signatures_modified 
"2026-09-20T14:16:31Z"