{"id":"CVE-2026-84444","summary":"libheif uncompressed tiled image encoding allows out-of-bounds write","details":"libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, when WITH_UNCOMPRESSED_CODEC is enabled, heif_context_add_image_tile() accepts an independently constructed tile whose component-plane dimensions do not match the tile geometry established by the prototype image. ImageItem_uncompressed::add_image_tile() passes that tile directly to unc_encoder::encode_tile(), which lacked the check_component_sizes() gate and sizes its output from the configured tile geometry while copying the tile's actual component-plane dimensions. An oversized component plane can therefore make unc_encoder_component_interleave::encode_tile() copy attacker-controlled data beyond the heap output buffer. This issue is fixed in version 1.23.2.","aliases":["GHSA-j264-xvrp-5v7q"],"modified":"2026-09-20T14:16:31.433534Z","published":"2026-09-18T15:56:41.773Z","related":["openSUSE-SU-2026:11719-1"],"database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-787"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84444.json"},"references":[{"type":"WEB","url":"https://github.com/strukturag/libheif/releases/tag/v1.23.2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84444.json"},{"type":"ADVISORY","url":"https://github.com/strukturag/libheif/security/advisories/GHSA-j264-xvrp-5v7q"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84444"},{"type":"FIX","url":"https://github.com/strukturag/libheif/commit/e65071f59a1ac08aa1eb0d07a831deaf6bb4d03b"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/strukturag/libheif","events":[{"introduced":"0"},{"fixed":"e65071f59a1ac08aa1eb0d07a831deaf6bb4d03b"},{"fixed":"ac1cb05c39008f01525c991ff8b88f84ddf70fd2"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"1.23.2"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["v1.23.1","v1.23.0","v1.22.2","v1.22.1","v1.22.0","v1.21.2","v1.21.1","v1.21.0","v1.20.1","v1.20.0","v1.19.5","v1.19.4","v1.19.3","v1.19.2","v1.19.1","v1.19.0","v1.18.0","v1.18.0-rc1","v1.17.6","v1.17.5","v1.17.4","v1.17.3","v1.17.2","v1.17.1","v1.17.0","v1.16.2","v1.16.1","v1.16.0","v1.15.2","v1.15.1","v1.15.0","v1.14.2","v1.14.1","v1.14.0","v1.13.0","v1.12.0","v1.11.0","v1.10.0","v1.9.1","v1.9.0","v1.8.0","v1.7.0","v1.3.2","v1.3.1","v1.3.0","v1.2.0","v1.1.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-84444.json","vanir_signatures_modified":"2026-09-20T14:16:31Z","vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"21746799924861355163437522053638053791","length":553},"id":"CVE-2026-84444-015aeed2","signature_type":"Function","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/e65071f59a1ac08aa1eb0d07a831deaf6bb4d03b","target":{"function":"unc_encoder_rgb_pixel_interleave::encode_tile","file":"libheif/codecs/uncompressed/unc_encoder_rgb_pixel_interleave.cc"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/e65071f59a1ac08aa1eb0d07a831deaf6bb4d03b","target":{"file":"libheif/codecs/uncompressed/unc_encoder_component_interleave.cc","function":"unc_encoder_component_interleave::encode_tile"},"deprecated":false,"digest":{"function_hash":"339053753553694708719272824858320798558","length":1374},"id":"CVE-2026-84444-0d1898cc"},{"signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/e65071f59a1ac08aa1eb0d07a831deaf6bb4d03b","target":{"file":"libheif/codecs/uncompressed/unc_encoder_rgb_block_pixel_interleave.h"},"deprecated":false,"digest":{"line_hashes":["272508509191830491342494097314539974518","235516039192449299655073584868728377238","180255066410459710284475010498850818582","53453415080009535891701420818251941128"],"threshold":0.9},"id":"CVE-2026-84444-1301af13","signature_type":"Line"},{"target":{"file":"libheif/codecs/uncompressed/unc_encoder_rgb_pixel_interleave.cc"},"deprecated":false,"digest":{"line_hashes":["252496850934115909011917543035431079937","285213048824327950360827763969006111810","128066993627106190106369174577076814780","192407410311491770485233329107571673709"],"threshold":0.9},"id":"CVE-2026-84444-18117956","signature_type":"Line","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/e65071f59a1ac08aa1eb0d07a831deaf6bb4d03b"},{"deprecated":false,"digest":{"function_hash":"54456283306235187668712273853588813052","length":1631},"id":"CVE-2026-84444-36f56170","signature_type":"Function","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/e65071f59a1ac08aa1eb0d07a831deaf6bb4d03b","target":{"file":"libheif/image-items/unc_image.cc","function":"ImageItem_uncompressed::add_image_tile"}},{"target":{"file":"libheif/codecs/uncompressed/unc_encoder_component_interleave.cc"},"deprecated":false,"digest":{"line_hashes":["277510542258743573843713935664483449148","325361898010874525974302550750320084045","157810602971243530690075955855225716739","172913901896238774105002555084028970686"],"threshold":0.9},"id":"CVE-2026-84444-398cee4d","signature_type":"Line","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/e65071f59a1ac08aa1eb0d07a831deaf6bb4d03b"},{"target":{"file":"libheif/codecs/uncompressed/unc_encoder_component_interleave.h"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["282744426550898960184023324375774353057","235516039192449299655073584868728377238","60862148676925708000053116504191937936","299917853079934832457454054394982525605"]},"id":"CVE-2026-84444-54c331b9","signature_type":"Line","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/e65071f59a1ac08aa1eb0d07a831deaf6bb4d03b"},{"id":"CVE-2026-84444-6479836a","signature_type":"Line","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/e65071f59a1ac08aa1eb0d07a831deaf6bb4d03b","target":{"file":"libheif/image-items/unc_image.cc"},"deprecated":false,"digest":{"line_hashes":["51671866959765109462479787443437198413","235458970753796469972344410901568343968","122259460503554911389944695346544209947"],"threshold":0.9}},{"target":{"file":"libheif/codecs/uncompressed/unc_encoder.cc","function":"unc_encoder::check_component_sizes"},"deprecated":false,"digest":{"function_hash":"98230121587451678300642081428586097515","length":804},"id":"CVE-2026-84444-71f0c24d","signature_type":"Function","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/e65071f59a1ac08aa1eb0d07a831deaf6bb4d03b"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["327584256131400416990283458639637735342","150521944305682235156197095707827601555","132173395448906562778867830395947441583","37595243237851887872946052818262973764"]},"id":"CVE-2026-84444-7290276f","signature_type":"Line","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/e65071f59a1ac08aa1eb0d07a831deaf6bb4d03b","target":{"file":"libheif/codecs/uncompressed/unc_encoder_rgb_bytealign_pixel_interleave.cc"}},{"id":"CVE-2026-84444-87953dec","signature_type":"Line","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/e65071f59a1ac08aa1eb0d07a831deaf6bb4d03b","target":{"file":"libheif/codecs/uncompressed/unc_encoder.cc"},"deprecated":false,"digest":{"line_hashes":["147265845980681057220894443382109274415","121729813977482933843265342035197979585","98780181033568596274007457729365626509","16926201035863103934764882457658646320","223688294277509300805514948488429825761","20316594947244329398420210372722577656","187881254747437409832609240900622487906","175664231501580699883407099769528893196","85864490079226284276775000077592155984","66606399785682967105002416499382955010","217285423227910428507329040730804783835","151130156779126251866507075838571914127","318028540634824965530598004759562385812","121543116200292864115042410266393940493","24088311608785076088563676821181554303","267091972954580097690229634695243789239","171490079832720437849107268556565816027","89800332491236188370761476035543885107","184479302279232768650820080103922531901","225830844949296922491642008429314490213","28593658212750657339482885315906225112","42298573558624629541191320980828036068","191968164562695690412176409160265944258"],"threshold":0.9}},{"signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/e65071f59a1ac08aa1eb0d07a831deaf6bb4d03b","target":{"file":"libheif/codecs/uncompressed/unc_encoder_rgb_bytealign_pixel_interleave.h"},"deprecated":false,"digest":{"line_hashes":["234824126970031566612024301970550181828","235516039192449299655073584868728377238","180255066410459710284475010498850818582","124427104851535784840879970951635803245"],"threshold":0.9},"id":"CVE-2026-84444-89a46f43","signature_type":"Line"},{"deprecated":false,"digest":{"function_hash":"180168724888657706329481143524143646066","length":1205},"id":"CVE-2026-84444-a120abb6","signature_type":"Function","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/e65071f59a1ac08aa1eb0d07a831deaf6bb4d03b","target":{"file":"libheif/codecs/uncompressed/unc_encoder_rgb_block_pixel_interleave.cc","function":"unc_encoder_rgb_block_pixel_interleave::encode_tile"}},{"signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/e65071f59a1ac08aa1eb0d07a831deaf6bb4d03b","target":{"file":"libheif/codecs/uncompressed/unc_encoder_rgb_pixel_interleave.h"},"deprecated":false,"digest":{"line_hashes":["158576073809515518585411567890328240680","235516039192449299655073584868728377238","180255066410459710284475010498850818582","53453415080009535891701420818251941128"],"threshold":0.9},"id":"CVE-2026-84444-b3843b1b","signature_type":"Line"},{"signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/e65071f59a1ac08aa1eb0d07a831deaf6bb4d03b","target":{"file":"libheif/codecs/uncompressed/unc_encoder.cc","function":"unc_encoder::unc_encoder"},"deprecated":false,"digest":{"function_hash":"129658024547413652388017973774020297612","length":2016},"id":"CVE-2026-84444-bb89deee","signature_type":"Function"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/e65071f59a1ac08aa1eb0d07a831deaf6bb4d03b","target":{"file":"libheif/codecs/uncompressed/unc_encoder_rgb_bytealign_pixel_interleave.cc","function":"unc_encoder_rgb_bytealign_pixel_interleave::encode_tile"},"deprecated":false,"digest":{"length":743,"function_hash":"149996418315585050558591882635503094058"},"id":"CVE-2026-84444-dc1e9f43"},{"id":"CVE-2026-84444-e5c4ef1d","signature_type":"Line","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/e65071f59a1ac08aa1eb0d07a831deaf6bb4d03b","target":{"file":"libheif/codecs/uncompressed/unc_encoder.h"},"deprecated":false,"digest":{"line_hashes":["270345007932426470533034664082651900722","311700578842240251868353410178576378338","331989777216935185759196951906977560780","191721132049715985171885550116790556439","144278405828839306803258310250053106876","71553457533013616915977835562773638678","40809518408798403491006018595191109935","297546825929376579915121987660649533244","222850253593506205791767872186297163188","160408518410720507288913800282687322535","17361388898286060216254406706865230516","170098999886335993737446375501868117212"],"threshold":0.9}},{"deprecated":false,"digest":{"line_hashes":["294041675119103317862599308653451881740","209501904055638032333384381978771569575","243024793596170121834922607182188516874","62219823176585999309586482750604416674"],"threshold":0.9},"id":"CVE-2026-84444-ebc999e4","signature_type":"Line","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/e65071f59a1ac08aa1eb0d07a831deaf6bb4d03b","target":{"file":"libheif/codecs/uncompressed/unc_encoder_rgb_block_pixel_interleave.cc"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H"}]}