CVE-2026-84446
- Source
- https://cve.org/CVERecord?id=CVE-2026-84446
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-84446.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-84446
- Aliases
-
- GHSA-xw34-mjcp-jqh8
- Downstream
- Related
- Published
- 2026-09-18T15:54:48Z
- Modified
- 2026-09-20T14:24:07Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- libheif: Sequence decode timing-table initialization allows non-terminating loops and unbounded memory, bypassing max_sequence_frames
- Details
-
libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, crafted HEIF sequence timing and edit-list data can make Track::init_sample_timing_table() compute a logical m_num_output_samples value that exceeds the uint32_t counters used by Track_Visual::decode_next_image_sample() and Track::get_next_sample_raw_data(). The resulting comparison can never reach the oversized output count, causing non-terminating decode or raw-sample loops and bypassing max_sequence_frames. The same sequence path repeatedly calls Box_stts::get_sample_duration() and allocates Chunk::m_sample_ranges and Track::m_presentation_timeline outside MemoryHandle accounting, allowing severe CPU and memory exhaustion from a small file. This issue is fixed in version 1.23.2.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-835" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84446.json" }- References
-
- https://github.com/strukturag/libheif/releases/tag/v1.23.2
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84446.json
- https://github.com/strukturag/libheif/security/advisories/GHSA-xw34-mjcp-jqh8
- https://nvd.nist.gov/vuln/detail/CVE-2026-84446
- https://github.com/strukturag/libheif/commit/3a7a69ae325f652e48c026b8241ab25bedf44d9b
Affected packages
Git / github.com/strukturag/libheif
Affected versions
v1.*
v1.1.0
v1.10.0
v1.11.0
v1.12.0
v1.13.0
v1.14.0
v1.14.1
v1.14.2
v1.15.0
v1.15.1
v1.15.2
v1.16.0
v1.16.1
v1.16.2
v1.17.0
v1.17.1
v1.17.2
v1.17.3
v1.17.4
v1.17.5
v1.17.6
v1.18.0
v1.18.0-rc1
v1.19.0
v1.19.1
v1.19.2
v1.19.3
v1.19.4
v1.19.5
v1.2.0
v1.20.0
v1.20.1
v1.21.0
v1.21.1
v1.21.2
v1.22.0
v1.22.1
v1.22.2
v1.23.0
v1.23.1
v1.3.0
v1.3.1
v1.3.2
v1.7.0
v1.8.0
v1.9.0
v1.9.1
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-84446.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"function_hash": "214933846367695958294950061772048859597",
"length": 707
},
"id": "CVE-2026-84446-029d9ddc",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/strukturag/libheif/commit/3a7a69ae325f652e48c026b8241ab25bedf44d9b",
"target": {
"file": "libheif/sequences/chunk.cc",
"function": "Chunk::Chunk"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"94029682718396319588806886797191216523",
"190069696010844777553685633794800281652",
"157637199469358556709478125125418879103",
"133667808799523002639185476529093575445",
"143891370381015109635809782430057214092",
"53754837282514803437296311766165616792",
"30607554910599198844209773248555536073",
"139150419137203484310545878824833107548",
"80722021415917334020000974162728222442",
"310387943699171552091659672051628357219",
"232745636699536290086318196903753250699",
"261712604978385040778555695860293596914",
"61428428318562086563167339518173129735",
"113956117180611673704165393897257018736"
],
"threshold": 0.9
},
"id": "CVE-2026-84446-09b3f0ee",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/strukturag/libheif/commit/3a7a69ae325f652e48c026b8241ab25bedf44d9b",
"target": {
"file": "libheif/api/libheif/heif_sequences.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"35342666571605865147842612517050220917",
"287229249279181186612165283850670306511",
"193092517571909881580793811016546472503",
"212031746523107034394819109023728139849",
"117666909314184400028011588435377491458",
"89309366363186102405416124934718466955",
"128446776291471556548058936183452513816",
"92019663638951323149170201904847740895",
"167411571849218390661339148880009667751",
"329277373922459985718051206622050699745",
"145014453656847425005179969989210116144",
"53144035516234178620266576477161201316",
"260986193419446679110449712151881417784",
"219359801539103073724646551234915602043",
"54951389403599190031828736915953134719",
"292589724698660979408839187744043983339",
"104043850816289487094495145384317606598",
"12226511761367772264028731866512969073",
"67129963979537695926034775316552667649",
"36960656503897558628550377796862770047",
"228853684611296893526348667802072041119"
],
"threshold": 0.9
},
"id": "CVE-2026-84446-0b2c05cc",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/strukturag/libheif/commit/3a7a69ae325f652e48c026b8241ab25bedf44d9b",
"target": {
"file": "libheif/sequences/seq_boxes.cc"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "185392715999676746011866592077050038448",
"length": 395
},
"id": "CVE-2026-84446-13bd9007",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/strukturag/libheif/commit/3a7a69ae325f652e48c026b8241ab25bedf44d9b",
"target": {
"file": "libheif/api/libheif/heif_sequences.cc",
"function": "heif_track_get_next_raw_sequence_sample"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "301091381237285897973836195589053381279",
"length": 213
},
"id": "CVE-2026-84446-228a8c57",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/strukturag/libheif/commit/3a7a69ae325f652e48c026b8241ab25bedf44d9b",
"target": {
"file": "libheif/sequences/seq_boxes.cc",
"function": "Box_stts::get_sample_duration"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"67353204229428082407670612129176134445",
"10692812207201462562933885748077633578",
"211364489919503480940700103170143993173",
"139223613953805144407491831216303397455",
"315030640464771856834684003335890778778"
],
"threshold": 0.9
},
"id": "CVE-2026-84446-31d08309",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/strukturag/libheif/commit/3a7a69ae325f652e48c026b8241ab25bedf44d9b",
"target": {
"file": "libheif/sequences/seq_boxes.h"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "38824358461025045937522832477378729883",
"length": 1843
},
"id": "CVE-2026-84446-4bef2533",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/strukturag/libheif/commit/3a7a69ae325f652e48c026b8241ab25bedf44d9b",
"target": {
"file": "libheif/sequences/track.cc",
"function": "Track::init_sample_timing_table"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "90534910519880226680938961248971161295",
"length": 1399
},
"id": "CVE-2026-84446-55e37c2e",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/strukturag/libheif/commit/3a7a69ae325f652e48c026b8241ab25bedf44d9b",
"target": {
"file": "libheif/sequences/seq_boxes.cc",
"function": "Box_stts::parse"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"301194703488114485749827611927674985282",
"236149742013636793873287156916803540744",
"184861557185270852143382771802330335567",
"287651502372738151060250743614418482564",
"233530404088686372445289252625174431405",
"273880182853305546459092045819632257825",
"35249592911736603212109717574680429132",
"205000711021157322006335102950585118919",
"65542723844925540856241596775039314586",
"241785518909502806260364525012003950299",
"4427765169948592768210361105998302589",
"143011245375944104540908583488221213590",
"86085322055015326711457787259987479268",
"147610396356010432821193832871336318859",
"96857389892209546677945009301182932991",
"277328950910190322621139731183828446807",
"15437271226762435511151320630312606529",
"135766593263803881155127177756619973934",
"41718405946854162568835712237686891729",
"74479830168626959110776729428178691035",
"61059947807228386904395624472003311878",
"210382586985422541368470054482910342562",
"49779345414653513690987359238108796627",
"143725967532070990061829205890473374799",
"182426421169103345375453900398187277696",
"70225532830155934633485671969200787828",
"283664470353904440386406737331270788815",
"299377539309858620533383321759530846602",
"145834438365498133511991901320801694992",
"67797506768090357386383531200422932386",
"154376768546902061510203289603299476224"
],
"threshold": 0.9
},
"id": "CVE-2026-84446-75ea2467",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/strukturag/libheif/commit/3a7a69ae325f652e48c026b8241ab25bedf44d9b",
"target": {
"file": "libheif/sequences/track.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"55414199801314843977095354184174427886",
"171775023902277528805886308904533374377",
"42785001144671198056698880257946971463",
"250966162490475855616904600887313834149",
"187833353584362982697324742811061135823",
"17875534399085799583433075141140164355"
],
"threshold": 0.9
},
"id": "CVE-2026-84446-84adafeb",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/strukturag/libheif/commit/3a7a69ae325f652e48c026b8241ab25bedf44d9b",
"target": {
"file": "libheif/sequences/chunk.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"3784826678204325775113351581638125103",
"199451691174681918115534036534247690852",
"280711593927841030182647475176403185055"
],
"threshold": 0.9
},
"id": "CVE-2026-84446-a777811d",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/strukturag/libheif/commit/3a7a69ae325f652e48c026b8241ab25bedf44d9b",
"target": {
"file": "libheif/sequences/chunk.h"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "239213717329821600948057855253015536995",
"length": 8099
},
"id": "CVE-2026-84446-c04168c4",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/strukturag/libheif/commit/3a7a69ae325f652e48c026b8241ab25bedf44d9b",
"target": {
"file": "libheif/sequences/track.cc",
"function": "Track::load"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"197672005116171887413656356606798062540",
"21617381069090522328108345711639554808",
"168270884774813619993770027994812981031",
"203072752521137395174407669768991987854",
"111095664324108917522022521514880144883",
"259961189218983245079391918085507965193",
"252001404115677658987443607680107700763",
"132516557227872938993828699452646859932",
"330605546018728396386786181342068490692",
"93839257526745839880135513582907429674",
"178529813395056683743241471323432653882"
],
"threshold": 0.9
},
"id": "CVE-2026-84446-d0a19d08",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/strukturag/libheif/commit/3a7a69ae325f652e48c026b8241ab25bedf44d9b",
"target": {
"file": "libheif/sequences/track.h"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "71449595084554970561218109862331987921",
"length": 308
},
"id": "CVE-2026-84446-ffc77356",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/strukturag/libheif/commit/3a7a69ae325f652e48c026b8241ab25bedf44d9b",
"target": {
"file": "libheif/sequences/seq_boxes.cc",
"function": "Box_stts::append_sample_duration"
}
}
]
vanir_signatures_modified
"2026-09-20T14:24:07Z"