CVE-2026-84450
- Source
- https://cve.org/CVERecord?id=CVE-2026-84450
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-84450.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-84450
- Aliases
-
- GHSA-gh5q-69gg-c964
- Downstream
- Related
- Published
- 2026-09-18T16:04:54Z
- Modified
- 2026-09-20T14:16:33Z
- Severity
-
- 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVSS Calculator
- Summary
- libheif: `clap` + oversized `ispe` aborts on an assert in `Fraction::Fraction` (incomplete fix for CVE-2026-62289)
- Details
-
libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.3, a crafted image item containing a clap property and an ispe width or height greater than INT32_MAX + 1 can reach crop calculations through heif_image_handle_get_image_tiling(). Box_clap::left_rounded() or Box_clap::top_rounded() passes the image dimension minus one to Fraction::Fraction(), whose uint32_t constructor uses an assertion as input validation, causing assert-enabled builds to abort. Release builds can instead compute invalid crop geometry, and the tiling API returns dimensions that the normal decode security limits reject. This issue is fixed in version 1.23.3.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-617" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84450.json" }- References
-
- https://github.com/strukturag/libheif/releases/tag/v1.23.3
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84450.json
- https://github.com/strukturag/libheif/security/advisories/GHSA-gh5q-69gg-c964
- https://nvd.nist.gov/vuln/detail/CVE-2026-84450
- https://github.com/strukturag/libheif/commit/1c2df9c0e814f89716f3a4d85a444b2dbc63ad69
Affected packages
Git / github.com/strukturag/libheif
Affected versions
v1.*
v1.19.0
v1.19.1
v1.19.2
v1.19.3
v1.19.4
v1.19.5
v1.20.0
v1.20.1
v1.21.0
v1.21.1
v1.21.2
v1.22.0
v1.22.1
v1.22.2
v1.23.0
v1.23.1
v1.23.2
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-84450.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"function_hash": "170352982320314727288744613012883382006",
"length": 146
},
"id": "CVE-2026-84450-00653c60",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/strukturag/libheif/commit/1c2df9c0e814f89716f3a4d85a444b2dbc63ad69",
"target": {
"file": "libheif/box.cc",
"function": "Box_clap::bottom_rounded"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "84801817531525487812441398826197265663",
"length": 2617
},
"id": "CVE-2026-84450-06236585",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/strukturag/libheif/commit/1c2df9c0e814f89716f3a4d85a444b2dbc63ad69",
"target": {
"file": "libheif/image-items/image_item.cc",
"function": "ImageItem::process_image_transformations_on_tiling"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "117766026511850685951781439275022328858",
"length": 2939
},
"id": "CVE-2026-84450-080503c9",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/strukturag/libheif/commit/1c2df9c0e814f89716f3a4d85a444b2dbc63ad69",
"target": {
"file": "libheif/image-items/image_item.cc",
"function": "ImageItem::encode_to_bitstream_and_boxes"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "234639112024092236682206552516297962959",
"length": 386
},
"id": "CVE-2026-84450-131aecaa",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/strukturag/libheif/commit/1c2df9c0e814f89716f3a4d85a444b2dbc63ad69",
"target": {
"file": "libheif/box.cc",
"function": "Box_clap::set"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "9871523502093639542826212795670247503",
"length": 814
},
"id": "CVE-2026-84450-197eb665",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/strukturag/libheif/commit/1c2df9c0e814f89716f3a4d85a444b2dbc63ad69",
"target": {
"file": "libheif/api/libheif/heif_regions.cc",
"function": "heif_region_get_ellipse_transformed"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "92223832002201552232050025727754881407",
"length": 2084
},
"id": "CVE-2026-84450-1af49e76",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/strukturag/libheif/commit/1c2df9c0e814f89716f3a4d85a444b2dbc63ad69",
"target": {
"file": "libheif/region.cc",
"function": "RegionCoordinateTransform::create"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"268251884144407872354344751837669957540",
"19267534886406717470654700654875607406",
"108209307826903591192771400051484023379",
"45187466633410220095813558090047452710",
"64954764387705636606795003830481280355",
"87720207547153422768807851370000558808",
"183661222707906792760375897021443508722"
],
"threshold": 0.9
},
"id": "CVE-2026-84450-31f84fe5",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/strukturag/libheif/commit/1c2df9c0e814f89716f3a4d85a444b2dbc63ad69",
"target": {
"file": "tests/clap_zero_size.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"81189473444326824340458853501704986032",
"290054077854075238905556077258116230744",
"272388574348505325694056442565850308590",
"215164151527817340277731745962709264302",
"280817345144013038310304765868077619359",
"264579947815058985105978025620651319471",
"44135028219028384334168273590313734239",
"217771455442337385368486223602406153430",
"294007344696754108385288616715820776665",
"201652904324723977724354857783643853268",
"119109811055955452149630180842911811047",
"268794617575005519526361858942920665201",
"17807591767525866418346977461390185117",
"198401051491998695954210789155503600424",
"29315864598603023041304740458877134028",
"261567503662376788771487805015530713264",
"266701854624498069049022107772793441114"
],
"threshold": 0.9
},
"id": "CVE-2026-84450-3ae38d47",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/strukturag/libheif/commit/1c2df9c0e814f89716f3a4d85a444b2dbc63ad69",
"target": {
"file": "libheif/box.h"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"5418321465095265478569633563467558857",
"259012962753716251949474718471312250437",
"235395909871356389755057843015152017710",
"20537228470261346156102192669510588305",
"240832115920901628516429567008603646419",
"87217171356428626415554221515175935732",
"119833364548873398272556252897698933330",
"152455637982621609680230557109091611024",
"248782263335093579476082308676407354195",
"141297713827942371433672872199945885489",
"247502477714191923632438729670534965209",
"132792040648293469141744351897865501469",
"331773948349549407126851596160435338743",
"270859120036307983643189890762083303273",
"218308362795402195851732438985599455369",
"272877390717777897910329198943701316105",
"338688213747510562807225534683305216247",
"259194024724644496508937570211511597521",
"280580526226534798158850714783465056322",
"88830031508326288178383413214283072463",
"110546032103053653369599755084243426288",
"192932742315935615677887287017419051496"
],
"threshold": 0.9
},
"id": "CVE-2026-84450-427f8888",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/strukturag/libheif/commit/1c2df9c0e814f89716f3a4d85a444b2dbc63ad69",
"target": {
"file": "libheif/api/libheif/heif_regions.cc"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "115052579700747108629740484593402429345",
"length": 1376
},
"id": "CVE-2026-84450-4caa3509",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/strukturag/libheif/commit/1c2df9c0e814f89716f3a4d85a444b2dbc63ad69",
"target": {
"file": "libheif/box.cc",
"function": "Box_clap::parse"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"75768431014019583542610806694366551045",
"315267201307178945931250154271779794888",
"58655109019694648157443446996324435832",
"208387783826684028194442685135619277050",
"99852781864429145549068977945461339001",
"161350378894856962815505270262247688208",
"10076131181781702535982188766250202697",
"250571638470768017642895330977346685827",
"185306094591504422021267062625832586007",
"213049373124272519614784489828686709649",
"6727680464017157358322224783246585527",
"308087949976358374500596800063281442744",
"155009477980197024259718029821667139567",
"330020505250092262218496724235738172",
"88497066675897404395645591465385376341",
"139787972436352344168938234074053572283",
"187243365223476472153325580936612525635",
"104507956059143900084904810320873684327",
"178137138070954540560058917045076918109",
"328096377236770504647867170327220913851",
"260322166541824208558891208079525664873",
"71516567050548733271756388613386294848"
],
"threshold": 0.9
},
"id": "CVE-2026-84450-5ca621aa",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/strukturag/libheif/commit/1c2df9c0e814f89716f3a4d85a444b2dbc63ad69",
"target": {
"file": "libheif/region.cc"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "226281592052854783402400051023189359122",
"length": 398
},
"id": "CVE-2026-84450-64c9fbed",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/strukturag/libheif/commit/1c2df9c0e814f89716f3a4d85a444b2dbc63ad69",
"target": {
"file": "libheif/api/libheif/heif_tiling.cc",
"function": "heif_image_handle_get_image_tiling"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "33795872010128422694317154617910030952",
"length": 687
},
"id": "CVE-2026-84450-66468b77",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/strukturag/libheif/commit/1c2df9c0e814f89716f3a4d85a444b2dbc63ad69",
"target": {
"file": "libheif/api/libheif/heif_regions.cc",
"function": "heif_region_get_point_transformed"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"1620407910751266711527282911832938461",
"30360575787415355202778462960736239805",
"162481910685423117407119838585916674354",
"260175152649542120922987689577727572599",
"79721250498196463561547401690412453669",
"88532202264208914842142529763227260860"
],
"threshold": 0.9
},
"id": "CVE-2026-84450-96a2be48",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/strukturag/libheif/commit/1c2df9c0e814f89716f3a4d85a444b2dbc63ad69",
"target": {
"file": "libheif/region.h"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "173342332708576643359912167084448522355",
"length": 816
},
"id": "CVE-2026-84450-99c77cdb",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/strukturag/libheif/commit/1c2df9c0e814f89716f3a4d85a444b2dbc63ad69",
"target": {
"file": "libheif/api/libheif/heif_regions.cc",
"function": "heif_region_get_rectangle_transformed"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"236922279648934148498209350462913887240",
"260568174343338832383123980275912300892",
"75580580013720514715796736988271806700",
"168356881211803960394494910375257351728",
"278204006449381252902192728356694539708",
"80379540296786899784438874204814527794",
"132405858996581144547809092241362333337",
"137895032315613481085067895365715089590",
"180452750203230654054655874423646322115",
"282978447995748836415190164824690185822",
"168005983343164709382259941041959431623",
"313065910502871695471982329652715414763",
"233602455365691503193809259878254078307",
"322258306231309156838006648504686633390",
"338613923013095232988527203545707756029",
"135175672422006490053953874498450566153",
"162512066392837427684140200557298936668",
"317559882751098652949094678886316364914",
"233769209111848154981591747780733913697",
"196478367281649555833495760677933041891",
"70338079347168111913964481073018192800",
"190500279469912681091854207129127695223",
"50723676690701298631785753164558872213",
"303399589947413558088876673363998189569",
"318140242263332858001500059686417459161",
"305506450374261850448097359477881603035",
"267895950008994570245964549195396493487",
"312557045952330308134158369311700968897",
"167221870312870160720703876364235059382",
"322076347100717720930543387748006479239",
"278567870706414271664590940579929829625",
"180031383472153806310311575322768412838",
"118608755182894771593238688242452839195",
"246400664116971424032054689724697744809",
"2505293888281333613865936768202015576",
"6261990847521115582968049546045185865",
"51455195865036997988602728799243608872",
"326915013791054243547432503433622917184",
"153729638320053135328296334236067242000",
"90140357598432249738546575993872355906",
"211133844083948072302587859101202437726",
"322093143448675408774094690647934401268",
"53289225644107102573701179285439902267",
"236861530612275708280587069914112295856",
"284149050971797366185658952097751281743",
"2264603734956223602784356224446684918",
"284401661024955786536687095469253823178",
"151586271326732800389454718483207821948",
"38503335020981498304074474397911877455",
"127466909818953668680143725322511619919",
"63510088722548834880820910870508870760",
"115791991165718696774003690431400132626",
"137324010870943696606616554403493641517",
"129057926945955871604546263559235916335",
"254162138698785018426550673615504218046",
"100154482184491145615330199543367105297",
"259375898483926044363976607405920957462",
"107930797245492306137662055010107730183",
"162689260716832606758007298521944251986",
"107098684136677834796365866789217642588",
"156051523067819366195009669116061492682",
"310821604170404302630282266644526591144",
"239675398904151654836294821723956611432",
"283023098752367401625163270827852760621",
"84700461003980936629658472822921007747",
"146092791380030021858017709407161221492",
"1871298624368751537322961729142709359",
"295518686231379152901312003834874823607",
"25041927548733113384627768728369932285",
"258253922833771847836691976905288350166",
"117836751211686569589506989616774897077",
"310646063803642230739295486102812734659",
"61353234701788143440838430817484829187",
"29578106650027953200504734942791170574"
],
"threshold": 0.9
},
"id": "CVE-2026-84450-9d8f7fc8",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/strukturag/libheif/commit/1c2df9c0e814f89716f3a4d85a444b2dbc63ad69",
"target": {
"file": "libheif/box.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"4583417437710926930468605614900546938",
"232171452795770586015451598601168802077",
"64579285460667564020485186516787524914",
"109445100049471951260472609636036737250",
"52405684407377087192831297028306196279",
"290487665071308142251048831924740904816",
"45009966382512091080624109168070623236",
"320164014037425194526400535339301184561",
"118082096661667247503456853607901743196",
"185356460945763674859572200957011742309",
"153113085911562452789876304402160014779",
"10477052147127239252484342186614998862",
"7963387667293819145035636941434163476",
"83912639743144115208549770672868318723",
"299469557644804427096511839740945331294",
"267462630300837346010039413190878347023",
"18102854472683722621156363421954992063",
"707032944084462745897715379281703634",
"57780416748452158382954541684193069648",
"205279754274402199517966393705742451586",
"180094309569076931671217717668101861781"
],
"threshold": 0.9
},
"id": "CVE-2026-84450-a3e6c9ca",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/strukturag/libheif/commit/1c2df9c0e814f89716f3a4d85a444b2dbc63ad69",
"target": {
"file": "libheif/image-items/image_item.cc"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "180750236809002837996667228347311700936",
"length": 535
},
"id": "CVE-2026-84450-c4cf91a7",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/strukturag/libheif/commit/1c2df9c0e814f89716f3a4d85a444b2dbc63ad69",
"target": {
"file": "libheif/api/libheif/heif_properties.cc",
"function": "heif_item_get_property_transform_crop_borders"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"160180322166677618717905025863552746813",
"229575095542331847900879582619104587338",
"314698629152800298130010615086811568683",
"321994066647726159154681188024222927967",
"37816035830277043237840213206762205407",
"306335721058643443031086489946249531557",
"114692023988093182583607667186837110260"
],
"threshold": 0.9
},
"id": "CVE-2026-84450-c5909e54",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/strukturag/libheif/commit/1c2df9c0e814f89716f3a4d85a444b2dbc63ad69",
"target": {
"file": "libheif/api/libheif/heif_tiling.cc"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "317255491326053409063057665346416783464",
"length": 229
},
"id": "CVE-2026-84450-c70fc930",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/strukturag/libheif/commit/1c2df9c0e814f89716f3a4d85a444b2dbc63ad69",
"target": {
"file": "libheif/box.cc",
"function": "Box_clap::top_rounded"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "105514758265391519493756472185271432138",
"length": 804
},
"id": "CVE-2026-84450-e691edb7",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/strukturag/libheif/commit/1c2df9c0e814f89716f3a4d85a444b2dbc63ad69",
"target": {
"file": "libheif/api/libheif/heif_regions.cc",
"function": "heif_region_get_poly_points_scaled"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "297387927326230468102578267438763705771",
"length": 7002
},
"id": "CVE-2026-84450-f17d2249",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/strukturag/libheif/commit/1c2df9c0e814f89716f3a4d85a444b2dbc63ad69",
"target": {
"file": "libheif/image-items/image_item.cc",
"function": "ImageItem::decode_image"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"117341716191190216891665852068886387535",
"80283016106231770685051696298403568118",
"111066827610544351763006848820853273481",
"290269113211922118813893700489794807064",
"98170933358179318930673513558676570007",
"70064461063123673005148343358236127090",
"267096856607624497503160459531039463338"
],
"threshold": 0.9
},
"id": "CVE-2026-84450-f2aeeac9",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/strukturag/libheif/commit/1c2df9c0e814f89716f3a4d85a444b2dbc63ad69",
"target": {
"file": "libheif/api/libheif/heif_properties.cc"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "220247447481347047988528273240694770125",
"length": 236
},
"id": "CVE-2026-84450-f42c2754",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/strukturag/libheif/commit/1c2df9c0e814f89716f3a4d85a444b2dbc63ad69",
"target": {
"file": "libheif/box.cc",
"function": "Box_clap::left_rounded"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "71719244247777127114217807071496421483",
"length": 144
},
"id": "CVE-2026-84450-fccf0f79",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/strukturag/libheif/commit/1c2df9c0e814f89716f3a4d85a444b2dbc63ad69",
"target": {
"file": "libheif/box.cc",
"function": "Box_clap::right_rounded"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "268463736170740840470419419484748167708",
"length": 274
},
"id": "CVE-2026-84450-fd65e55e",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/strukturag/libheif/commit/1c2df9c0e814f89716f3a4d85a444b2dbc63ad69",
"target": {
"file": "libheif/box.cc",
"function": "Fraction::Fraction"
}
}
]
vanir_signatures_modified
"2026-09-20T14:16:33Z"