DEBIAN-CVE-2026-84451

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-84451
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-84451.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-84451
Upstream
Published
2026-09-18T16:17:13Z
Modified
2026-09-19T05:00:31Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.3, the no-icef full-item branch of unc_decoder::get_compressed_image_data_uncompressed() in libheif/codecs/uncompressed/unc_decoder.cc retains an addition-based range check that can wrap when a crafted uncompressed tile grid produces a large range_start_offset and range_size. The overflow makes the bounds comparison pass and allows heif_image_handle_decode_image_tile() to call memcpy() with an invalid source pointer and a very large length when decoding a valid high-index advertised tile. This incomplete remediation of CVE-2026-62292 can reliably crash tile-processing applications, while whole-image decoding is not claimed to reach the demonstrated path. This issue is fixed in version 1.23.3.

References

Affected packages

Debian:12 / libheif

Package

Name
libheif
Purl
pkg:deb/debian/libheif?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.15.1-1
1.15.1-1+deb12u1
1.16.2-1
1.16.2-2
1.16.2-3
1.17.0-1
1.17.1-1
1.17.4-1
1.17.6-1
1.17.6-2
1.17.6-3
1.17.6-4
1.18.1-1
1.18.1-2
1.18.2-1
1.18.2-2
1.19.1-1~bpo12+1
1.19.1-1~bpo12+2
1.19.1-1
1.19.3-1~bpo12+1
1.19.3-1
1.19.5-1
1.19.7-1~bpo12+1
1.19.7-1
1.19.8-1
1.20.1-1
1.20.2-1
1.20.2-2
1.21.2-1
1.21.2-2
1.21.2-3
1.21.2-4
1.23.1-1
1.23.2-1
1.23.3-1
1.23.4-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-84451.json"

Debian:13 / libheif

Package

Name
libheif
Purl
pkg:deb/debian/libheif?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.19.8-1
1.19.8-1+deb13u1
1.20.1-1
1.20.2-1
1.20.2-2
1.21.2-1
1.21.2-2
1.21.2-3
1.21.2-4
1.23.1-1
1.23.2-1
1.23.3-1
1.23.4-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-84451.json"

Debian:14 / libheif

Package

Name
libheif
Purl
pkg:deb/debian/libheif?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.23.3-1

Affected versions

1.*
1.19.8-1
1.20.1-1
1.20.2-1
1.20.2-2
1.21.2-1
1.21.2-2
1.21.2-3
1.21.2-4
1.23.1-1
1.23.2-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-84451.json"