{"id":"CVE-2026-84384","summary":"libheif: brotli/zlib decompression paths lack output-size limits, allowing decompression-bomb OOM/DoS","details":"libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.2, crafted HEIF or AVIF mime metadata and unci image data can cause decompress_brotli() and do_inflate() to grow accumulated output without an effective size limit or MemoryHandle accounting. The brotli path has no output bound, while the zlib path checks only a small temporary buffer in a branch that valid streams do not reach, and overlapping icef units can decompress the same payload repeatedly. HeifContext::interpret_heif_file_images() processes multiple compressed metadata items during file opening, allowing a small file to consume unbounded memory and terminate the process. This issue is fixed in version 1.23.2.","aliases":["GHSA-24wx-9w62-c96w"],"modified":"2026-09-20T14:16:32.887966Z","published":"2026-09-18T15:58:21.860Z","related":["openSUSE-SU-2026:11719-1"],"database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-409"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84384.json"},"references":[{"type":"WEB","url":"https://github.com/strukturag/libheif/releases/tag/v1.23.2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84384.json"},{"type":"ADVISORY","url":"https://github.com/strukturag/libheif/security/advisories/GHSA-24wx-9w62-c96w"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84384"},{"type":"FIX","url":"https://github.com/strukturag/libheif/commit/21893e8f66c8b79363ca2809391b07d35e1a95ec"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/strukturag/libheif","events":[{"introduced":"c4e4657dcf6bcc06e934632f97736f7c78dbff9e"},{"fixed":"21893e8f66c8b79363ca2809391b07d35e1a95ec"},{"fixed":"ac1cb05c39008f01525c991ff8b88f84ddf70fd2"}],"database_specific":{"extracted_events":[{"introduced":"1.19.0"},{"fixed":"1.23.2"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["v1.23.1","v1.23.0","v1.22.2","v1.22.1","v1.22.0","v1.21.2","v1.21.1","v1.21.0","v1.20.1","v1.20.0","v1.19.5","v1.19.4","v1.19.3","v1.19.2","v1.19.1","v1.19.0"],"database_specific":{"vanir_signatures":[{"digest":{"function_hash":"76319474047752418403516485028569914786","length":1847},"id":"CVE-2026-84384-1cb4ce12","signature_type":"Function","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/21893e8f66c8b79363ca2809391b07d35e1a95ec","target":{"file":"libheif/file.cc","function":"HeifFile::get_item_data"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/21893e8f66c8b79363ca2809391b07d35e1a95ec","target":{"file":"libheif/codecs/uncompressed/unc_decoder.cc","function":"unc_decoder::get_compressed_image_data_uncompressed"},"deprecated":false,"digest":{"function_hash":"157487306107788039413161003148305390417","length":2705},"id":"CVE-2026-84384-203dab2c","signature_type":"Function"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/21893e8f66c8b79363ca2809391b07d35e1a95ec","target":{"file":"libheif/image-items/image_item.h"},"deprecated":false,"digest":{"line_hashes":["67613014183781584501770202586658673229","250335245901152038044825155522604465396","310253159301865349404344107415074766740","274960629925950967920478328760518902893"],"threshold":0.9},"id":"CVE-2026-84384-6490cf19"},{"signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/21893e8f66c8b79363ca2809391b07d35e1a95ec","target":{"file":"libheif/codecs/uncompressed/unc_decoder.cc","function":"unc_decoder::do_decompress_data"},"deprecated":false,"digest":{"function_hash":"116427440774047655530186421366971630384","length":1410},"id":"CVE-2026-84384-6b0ac003","signature_type":"Function"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/21893e8f66c8b79363ca2809391b07d35e1a95ec","target":{"file":"libheif/compression_zlib.cc","function":"decompress_deflate"},"deprecated":false,"digest":{"function_hash":"232900574190866604432635952182809959685","length":71},"id":"CVE-2026-84384-6c7adc0c"},{"target":{"file":"libheif/file.cc","function":"HeifFile::get_uncompressed_item_data"},"deprecated":false,"digest":{"function_hash":"108714083514808708531797433942375872323","length":1925},"id":"CVE-2026-84384-6f67566d","signature_type":"Function","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/21893e8f66c8b79363ca2809391b07d35e1a95ec"},{"signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/21893e8f66c8b79363ca2809391b07d35e1a95ec","target":{"file":"libheif/compression_brotli.cc","function":"decompress_brotli"},"deprecated":false,"digest":{"function_hash":"31491800956507819973699993212958769776","length":1735},"id":"CVE-2026-84384-760ffe3e","signature_type":"Function"},{"target":{"file":"libheif/codecs/uncompressed/unc_decoder.cc"},"deprecated":false,"digest":{"line_hashes":["337402698982522818768453115248452863716","273775045201093665226557054864314069640","287377512904220069896472281021097624143","297544454543402510203489696669555160184","15069477689261345667400147023019975597","20035599782285024717854390321030970296","298299755873733723477005602968197832760","249680172299540367038446860534504167377","114372901442482635838059243550729732452","150079470882635811367143049767793890685","181815700386325355395553043185526388302","213802047352939133477196066926993532367","23825981181024632833672640522979877744","40216684338580870932498236331324866000","119487746908761162460828546010798315912","69475075158187828021872891792035399669","181593633110790192620034027550031603256","44725713610634506373779350088493585497","223391456085911267021515634294861491301","174152704098606491845852808853158609560","217628837151404931703445508086217565718","298299755873733723477005602968197832760","134899813883387261116883352291183875923","67520979377441854834467742947003215064","108327688421988283887026939215244119264","125485550392019319816979450162878576500","43678643956367090506081948023323536508","191248947384141395607809668367035084758","365334167329997286599295851142841929","162419962074931260072064198811449245239","249739091443343102097661046190743113105","93153716994463743244402348575584435946","163504636877760457645966891912032254471","175879163039549560051120449782228456159","159657351310710891549154283579310839963","113850013374679273458807996757684384582","97028600989716920936579207450492001873","75690279627393813637986443606471178296"],"threshold":0.9},"id":"CVE-2026-84384-7cc6457e","signature_type":"Line","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/21893e8f66c8b79363ca2809391b07d35e1a95ec"},{"deprecated":false,"digest":{"length":15718,"function_hash":"56754112790514173136872006025853258199"},"id":"CVE-2026-84384-95a4d1d0","signature_type":"Function","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/21893e8f66c8b79363ca2809391b07d35e1a95ec","target":{"file":"libheif/context.cc","function":"HeifContext::interpret_heif_file_images"}},{"deprecated":false,"digest":{"line_hashes":["34367767670864833874847156409340337901","217237620462167488836337582636688780039","264702505090844438538855330142505650041","4081605575643262922617498712234210930","56378817574695983279229405544665155832","220876429105524296929740067030179017613","243221816845614659971105475287072329648","84390917551752403837319818295656212317","26160608127328058830628093747624850282","73934482114016240680590812263469326591","27133021653873699984994797190466484399"],"threshold":0.9},"id":"CVE-2026-84384-a5633d67","signature_type":"Line","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/21893e8f66c8b79363ca2809391b07d35e1a95ec","target":{"file":"libheif/compression.h"}},{"deprecated":false,"digest":{"function_hash":"305484370907664425080354742460615680372","length":69},"id":"CVE-2026-84384-acbb4a70","signature_type":"Function","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/21893e8f66c8b79363ca2809391b07d35e1a95ec","target":{"file":"libheif/compression_zlib.cc","function":"decompress_zlib"}},{"signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/21893e8f66c8b79363ca2809391b07d35e1a95ec","target":{"file":"libheif/compression_brotli.cc"},"deprecated":false,"digest":{"line_hashes":["56633359397732090284360419082828317853","113917885697261490758623136371895073471","26926703758000121292570172662255793698","207279526463415765513095624115119658185","80584985660372658371162712480255138078","128145350354670123684099635473978014500","290909776618929512577480918715254824844","120917120930146469653016620474127638470","29590031730219084293399765212105896777","329120162372519494320945668576641555202","185912450964000104734291591993959301314","78889347051903908770529051532741356017","17302914435229375252637695525132305150","307433333012001257823625797541665806867","197951611354939188619656272373984470638","195268534000002981543246511534195397128","79134842032670611708331584177307544952","16753696803545996691318713103166583443","305695557920121151030007766708584424467","82412138421504323595298602565149225122"],"threshold":0.9},"id":"CVE-2026-84384-bea9f67f","signature_type":"Line"},{"target":{"file":"libheif/compression_zlib.cc","function":"do_inflate"},"deprecated":false,"digest":{"function_hash":"174779380109463199981668636194346742712","length":1967},"id":"CVE-2026-84384-d329d383","signature_type":"Function","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/21893e8f66c8b79363ca2809391b07d35e1a95ec"},{"id":"CVE-2026-84384-d816ddc4","signature_type":"Line","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/21893e8f66c8b79363ca2809391b07d35e1a95ec","target":{"file":"libheif/codecs/uncompressed/unc_decoder.h"},"deprecated":false,"digest":{"line_hashes":["41499496420030047762939737410179024888","3144515627737410214705377070098463280","132882009999885968516708350479917912099","162572599483684077189218633004986658989"],"threshold":0.9}},{"target":{"file":"libheif/context.cc"},"deprecated":false,"digest":{"line_hashes":["194174037093362768281887988035780120886","170534565249925808084737358741287442445","56424246243151345623585111402814895572","59680588937106104654512445389649371644"],"threshold":0.9},"id":"CVE-2026-84384-d8a4313d","signature_type":"Line","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/21893e8f66c8b79363ca2809391b07d35e1a95ec"},{"source":"https://github.com/strukturag/libheif/commit/21893e8f66c8b79363ca2809391b07d35e1a95ec","target":{"file":"libheif/file.cc"},"deprecated":false,"digest":{"line_hashes":["321884876527659878453632393318018429327","208516103718532913729907312089601221505","43261018444412162499039032357204834968","140307766128979326278636661303818969912","247347350494689641973538122890027956318","6081866251548643854058675499972505677","190415419445697362695206897638186262925","334781311975289627347335311435025848418","324910730284412701234337428909790765446","305877429759581964513361562091040226173","61015162469856807133065190105603282597","400948088925955245051530216936928700","102031103673957207890626172605644638517","49137096744071211295844807374800575604","37170190737741486915871524781023153384","325746603234512167377051217077656319249","18417741473044885913007272712877028655","108856610248609002459896637878892641140","10560604116210529127196989558725159773","334261172051837620603840851544174590117","154097542018695866033101368047789899624","74084142435965959220404623179097825389"],"threshold":0.9},"id":"CVE-2026-84384-efb5ffaf","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["192583725307888656787493191939659285412","100387613394044457986217241968684262300","8455801287648116889561699780420987078","90506980881719590667946372611257095202","140841000204803010165999255181227914769","63369095029931743387167918574699224433","40853485958087138831670755937271100294","126092809406888188784120322840405461514","16546558141616639975466249061485520675","114585454184288325358047881711929297264","22160405262411783023380412721346806357","244008003071627591075986437024645907806","173578189810179671589217659364730843637","125247897113510992309745811075729340424","76198025063292779618117795543755945422","88114433368126113463320845870531982050","37961613276371805624558830968388063167","78394615551833063442787100610146501459","317106303635899368297455486043027105092","244424265050937673216830621407705466874","157581483560846810531345074682577806633","145529324427143092859004434859023205520","320304633085637361705079251779363908248","18855153004064713215424539060863149333","277457163625021986485434163887976858251","95454790370299956339297307348399473624","154504451012395969699053992900600780882","237095330130171702761982475066526707509","136778505823142492993041307666479527497","12326152920251121979396505480149292150","165443121162123182062691249283232367694"]},"id":"CVE-2026-84384-fb1999bd","signature_type":"Line","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/21893e8f66c8b79363ca2809391b07d35e1a95ec","target":{"file":"libheif/compression_zlib.cc"}}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-84384.json","vanir_signatures_modified":"2026-09-20T14:16:32Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}