{"id":"CVE-2026-84447","summary":"libheif: Derived-image indirect reference chains and tiled offsets bypass decode caching and MemoryHandle limits, causing CPU/memory amplification DoS","details":"libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.1 and earlier, crafted grid, iovl, and iden reference graphs can repeatedly decode the same base image because processed_ids is copied per branch and ImageItem::decode_image() has no shared operation budget. This vulnerability is fixed in 1.23.2.","aliases":["GHSA-x8xm-cm2c-cfc8"],"modified":"2026-09-20T14:16:31.741959Z","published":"2026-09-18T16:00:51.589Z","related":["openSUSE-SU-2026:11719-1"],"database_specific":{"cwe_ids":["CWE-770"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84447.json","cna_assigner":"GitHub_M"},"references":[{"type":"WEB","url":"https://github.com/strukturag/libheif/releases/tag/v1.23.2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84447.json"},{"type":"ADVISORY","url":"https://github.com/strukturag/libheif/security/advisories/GHSA-x8xm-cm2c-cfc8"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84447"},{"type":"FIX","url":"https://github.com/strukturag/libheif/commit/30b52a4e829efe0ee6d7208e8500b99f664af5e9"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/strukturag/libheif","events":[{"introduced":"0"},{"fixed":"30b52a4e829efe0ee6d7208e8500b99f664af5e9"},{"fixed":"ac1cb05c39008f01525c991ff8b88f84ddf70fd2"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"1.23.2"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["v1.23.1","v1.23.0","v1.22.2","v1.22.1","v1.22.0","v1.21.2","v1.21.1","v1.21.0","v1.20.1","v1.20.0","v1.19.5","v1.19.4","v1.19.3","v1.19.2","v1.19.1","v1.19.0","v1.18.0","v1.18.0-rc1","v1.17.6","v1.17.5","v1.17.4","v1.17.3","v1.17.2","v1.17.1","v1.17.0","v1.16.2","v1.16.1","v1.16.0","v1.15.2","v1.15.1","v1.15.0","v1.14.2","v1.14.1","v1.14.0","v1.13.0","v1.12.0","v1.11.0","v1.10.0","v1.9.1","v1.9.0","v1.8.0","v1.7.0","v1.3.2","v1.3.1","v1.3.0","v1.2.0","v1.1.0"],"database_specific":{"vanir_signatures":[{"target":{"file":"libheif/image-items/unc_image.h"},"deprecated":false,"digest":{"line_hashes":["178556412125927716119150591717810927294","141393914407848918935049923832948531917","16089299114639770513397394958839758546","282958269143649021964410811661188374724"],"threshold":0.9},"id":"CVE-2026-84447-05767f98","signature_type":"Line","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/30b52a4e829efe0ee6d7208e8500b99f664af5e9"},{"deprecated":false,"digest":{"line_hashes":["211958307781879161269631797695610081858","158919303334851981263157766775268131499","332570338616001306356897286195095865830","52557481381616873189023456747819415749"],"threshold":0.9},"id":"CVE-2026-84447-068f3eeb","signature_type":"Line","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/30b52a4e829efe0ee6d7208e8500b99f664af5e9","target":{"file":"libheif/image-items/tiled.h"}},{"digest":{"line_hashes":["300103877884919396780022350352252774296","40953587550325015309445068933584626971","209949490565531024270590376902697075125","279491046240873225039909975822614103798","80239479899644784395112719412598410746","40290158416790407031645950584041705772","311364524622279570693635045569980080504"],"threshold":0.9},"id":"CVE-2026-84447-2217087f","signature_type":"Line","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/30b52a4e829efe0ee6d7208e8500b99f664af5e9","target":{"file":"libheif/image-items/tiled.cc"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/30b52a4e829efe0ee6d7208e8500b99f664af5e9","target":{"file":"libheif/image-items/image_item.h"},"deprecated":false,"digest":{"line_hashes":["123354530049035863446603873157620164423","162370650014261509852026700846003444671","50641702617805531125948660027924430460","93899519734200373169155369132960673455","310449066083517475197277959029400458151","306658868452128935230542192455843778901","124791405862986387612123166755756512775","133647856009995950689168131234382184202","202538524396436738425353418848397743417","254947409748288927042193056317185762852","193333751849290250050349645669531031067","295337413242634268274620511526513872302","218059828682436786747760409769964570137","335212213871026136692540998273283413235","225798951779808728482830518853006530228","180962837610320865144598744673275009431","192070579514559845076154577616076837768","123919501264041981242833406767083949237","334257756537074914949888708238648404953","286919588584474702594134855565475723652","184444652542714354934499567075014253505"],"threshold":0.9},"id":"CVE-2026-84447-28b3c0c0","signature_type":"Line"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/30b52a4e829efe0ee6d7208e8500b99f664af5e9","target":{"file":"libheif/image-items/iden.h"},"deprecated":false,"digest":{"line_hashes":["211958307781879161269631797695610081858","158919303334851981263157766775268131499","210099236199513536296480282556884437227","168378169153150439435642231706685456344"],"threshold":0.9},"id":"CVE-2026-84447-312fd638"},{"deprecated":false,"digest":{"line_hashes":["207036920736212603586799098254775633574","110695323711795064981411400278641843843","225717658291459754069819060775380103736","201586085318704956264419930164379014895","156894032951645811044737037464904300123","334588761198569673194363285190106649743","149792131022802854731042742184159705254","258709430150231159882378200164834515519","39338683565843903291687966885007221243","164280259235311073533331513409455382546","87428700332393752980947949999935016844","126572071093222972651611857281696748973","169646400031042361356579055874292864142","86606104921231852620274764896447322915","314015355365778738673379104815609373678"],"threshold":0.9},"id":"CVE-2026-84447-33a10b9d","signature_type":"Line","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/30b52a4e829efe0ee6d7208e8500b99f664af5e9","target":{"file":"libheif/image-items/iden.cc"}},{"deprecated":false,"digest":{"function_hash":"16619722755462700612355703594031608488","length":429},"id":"CVE-2026-84447-41d7755a","signature_type":"Function","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/30b52a4e829efe0ee6d7208e8500b99f664af5e9","target":{"file":"libheif/image-items/grid.cc","function":"ImageItem_Grid::decode_compressed_image"}},{"source":"https://github.com/strukturag/libheif/commit/30b52a4e829efe0ee6d7208e8500b99f664af5e9","target":{"file":"libheif/image-items/mask_image.h"},"deprecated":false,"digest":{"line_hashes":["44280462193159253004723767972337338244","264458506709639752250342955330482551655","262433252692135141790796199834732484075","179430452161083346083368695760578472873"],"threshold":0.9},"id":"CVE-2026-84447-4c1b19c1","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["170097568907878221910578626868434959801","331030084991514825926244865578532091098","61636462106489196120931388836592490159","9343806710573317883426036315211468176","293081083032188953058565249533380932537","116557782971454687841051668248151903858","87150466122631375375457124579300170189","250828304269309966455831436668094188323","86333610136801339947975533974530191473","20210149412959839209229720079212205000","33909382681933689091689425839391857662","19488371921973928509074421374276319849","274531650669381547256003211841840172724","48276903884059086155519765869399498482","28432810376479760327511694154776632984","186314433647921937769337385605823454095","167228745290611363439205059132830782958","332146900831675943209454572355800372882","60201480982264238195134036758570725059","17860717353603845956968588257102449357","299522641250364242698802206975550641444","326311802298886834053329540839731091135","328996271643974551517394901607645394299"],"threshold":0.9},"id":"CVE-2026-84447-4ceddfde","signature_type":"Line","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/30b52a4e829efe0ee6d7208e8500b99f664af5e9","target":{"file":"libheif/file.cc"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/30b52a4e829efe0ee6d7208e8500b99f664af5e9","target":{"file":"libheif/image-items/grid.cc"},"deprecated":false,"digest":{"line_hashes":["59859645088131406843165014489632003028","163846467843461872594342884413203366544","225717658291459754069819060775380103736","201586085318704956264419930164379014895","156894032951645811044737037464904300123","334588761198569673194363285190106649743","149792131022802854731042742184159705254","258709430150231159882378200164834515519","99893816495309655899529001941333575803","105272565360666617778864607793643942894","207907761396114508001950666848816192926","264457575756765818102000795562487975424","26885040949534041877408134696052497339","188734547229076476623405087262149642817","37155557589557278378188728290279818291","136505105831444188049120602069125620731","14852480325708032988925386340053937504","100088546847506514027712369954075633847","5462379732702792737260558479161477278","158875166987284005508900142699684914608","250407305486532967167680488538084570965","89842745264700079857932661158326248743","291861345536537433687386113587561493543","171704291281467443489683347200404604963","172279772254944693180335441851637946894","325171750050932948967159708693992338802","324208010956869228581600444889006227679","302159058118990089435403173838203742808","201558747735670253101327392673043675022","37421683945604203580034817625406007801","285517282490257772557966463912415081364","175252499601936733974703062515744448793","97745811222078022693773294520113546383","6755012641692333238240090479167228786","315468463938099060525305219254297456507","162146974443930101785998255970709183404","129962561473015323154332277753812997917","270962957149457719247123993034795284274","279013860144455414096996749571810321707","229375770397083856995274079296358015026","288103028222205415483645014191557317435","47139338096983220140312090832640249795","321976120392739178513018643234264587609","297082483870163676718631547977746459862"],"threshold":0.9},"id":"CVE-2026-84447-569eb15c"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/30b52a4e829efe0ee6d7208e8500b99f664af5e9","target":{"file":"libheif/image-items/unc_image.cc"},"deprecated":false,"digest":{"line_hashes":["89315048646603448096316437783495034455","75885069082027712001353901762701182139","222895104460419287334360275504295270330","252192871431756287008897227601375483823"],"threshold":0.9},"id":"CVE-2026-84447-6ad3dab2"},{"deprecated":false,"digest":{"function_hash":"45624358545668183765757899277169641522","length":704},"id":"CVE-2026-84447-75cd8aa9","signature_type":"Function","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/30b52a4e829efe0ee6d7208e8500b99f664af5e9","target":{"file":"libheif/image-items/image_item.cc","function":"ImageItem::decode_compressed_image"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/30b52a4e829efe0ee6d7208e8500b99f664af5e9","target":{"file":"libheif/image-items/overlay.cc","function":"ImageItem_Overlay::decode_overlay_image"},"deprecated":false,"digest":{"function_hash":"102801960211358705552855663874307474649","length":2543},"id":"CVE-2026-84447-790f072e"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/30b52a4e829efe0ee6d7208e8500b99f664af5e9","target":{"file":"libheif/image-items/image_item.cc","function":"ImageItem::decode_image"},"deprecated":false,"digest":{"function_hash":"290039640839102531792932849862784296910","length":6784},"id":"CVE-2026-84447-8821b1f1"},{"target":{"file":"libheif/image-items/iden.cc","function":"ImageItem_iden::decode_compressed_image"},"deprecated":false,"digest":{"function_hash":"208182094162193404170601875859328293693","length":1397},"id":"CVE-2026-84447-97e2adac","signature_type":"Function","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/30b52a4e829efe0ee6d7208e8500b99f664af5e9"},{"source":"https://github.com/strukturag/libheif/commit/30b52a4e829efe0ee6d7208e8500b99f664af5e9","target":{"file":"libheif/image-items/image_item.cc"},"deprecated":false,"digest":{"line_hashes":["274363282527800969765970638036527212816","80107533471356791435488816062866352921","69146295292483843008919672062931557391","54881890068558928006545298217985566976","142502387676050555731136912948354794308","161732950926814002380094267550163213819","149792131022802854731042742184159705254","317180147479150221707533200537655632801","105828929811200189817185657632339091736","56735809702928141201471396218003973728","337683904967263056009273116005726438429","21238402575257910791614657485793823531","178726286622599722910969183667396788388","276961485627454691455334350211473386999","155340637694079386040117139704661383477","142557962305638897837200846934406416498","15472741520593967809423515027050822858","286594328245567486960215029987240469394","245106243460339735651230063469458665316","325893317177831574263208821442690038118","69146295292483843008919672062931557391","54881890068558928006545298217985566976","142502387676050555731136912948354794308","161732950926814002380094267550163213819","149792131022802854731042742184159705254","161200537028621430493164809508572601420","97760367498445101224316600437107449072","53791313815202610748527700527787621476","244440806099795847586054577860149048618"],"threshold":0.9},"id":"CVE-2026-84447-9db5aaa3","signature_type":"Line","signature_version":"v1"},{"id":"CVE-2026-84447-a05166fa","signature_type":"Function","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/30b52a4e829efe0ee6d7208e8500b99f664af5e9","target":{"function":"HeifContext::decode_image","file":"libheif/context.cc"},"deprecated":false,"digest":{"function_hash":"67997773637395187932729988883105921108","length":754}},{"deprecated":false,"digest":{"line_hashes":["32426755678963257756245791730339606478","3011686189299772629533616651148685105","29345265983542067575559004813273527948"],"threshold":0.9},"id":"CVE-2026-84447-a65675a2","signature_type":"Line","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/30b52a4e829efe0ee6d7208e8500b99f664af5e9","target":{"file":"libheif/file.h"}},{"signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/30b52a4e829efe0ee6d7208e8500b99f664af5e9","target":{"file":"libheif/context.h"},"deprecated":false,"digest":{"line_hashes":["322082603270941989952771765147380552703","79954059160354134264215115602426083154","196835109807539074288390525674422578221","186525339007312988512642205878544171434"],"threshold":0.9},"id":"CVE-2026-84447-b08f6a56","signature_type":"Line"},{"deprecated":false,"digest":{"line_hashes":["335089714008183751514158927039862569220","186629598027679682866675064794707003091","94267000130499853820781949575733334816","107178200336992085867538110193961169640"],"threshold":0.9},"id":"CVE-2026-84447-b2308c20","signature_type":"Line","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/30b52a4e829efe0ee6d7208e8500b99f664af5e9","target":{"file":"libheif/context.cc"}},{"signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/30b52a4e829efe0ee6d7208e8500b99f664af5e9","target":{"file":"libheif/image-items/grid.h"},"deprecated":false,"digest":{"line_hashes":["211958307781879161269631797695610081858","158919303334851981263157766775268131499","32866476845053130057097528695425173277","88357067223890076115125123219520848343","146419452617958007712341440858095647812","299554861817986448411022278671026060495","310946760336286236618214706140453845915","51513542650658705999197352549888138864","6171319308083877660010635154180049649","3243101173761805609300093432967833805","185041422282291186136014788931274159480","317180087638822848598391949300416727643","154668894269606920170463446979331719957"],"threshold":0.9},"id":"CVE-2026-84447-bf98d2c6","signature_type":"Line"},{"source":"https://github.com/strukturag/libheif/commit/30b52a4e829efe0ee6d7208e8500b99f664af5e9","target":{"function":"HeifFile::check_for_ref_cycle","file":"libheif/file.cc"},"deprecated":false,"digest":{"function_hash":"93324698248455839673811143568615752248","length":139},"id":"CVE-2026-84447-c7076627","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/strukturag/libheif/commit/30b52a4e829efe0ee6d7208e8500b99f664af5e9","target":{"file":"libheif/image-items/overlay.h"},"deprecated":false,"digest":{"line_hashes":["211958307781879161269631797695610081858","155532658373342785108954356807889065819","225109934931208613019912521400854008997","182555227970913904602886003414757910052","58218356949955708430312261062792436159","163593397494983496088755980604435270898","130007688314107627296349995071402495421"],"threshold":0.9},"id":"CVE-2026-84447-d49b2602","signature_type":"Line","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/30b52a4e829efe0ee6d7208e8500b99f664af5e9","target":{"file":"libheif/file.cc","function":"HeifFile::check_for_ref_cycle_recursion"},"deprecated":false,"digest":{"function_hash":"209914828828259386950930211940209027800","length":517},"id":"CVE-2026-84447-d4c39d2d"},{"digest":{"line_hashes":["338072947281889058412142207277247812458","256136654504131871300274251879252197040","62279093192964837845271255829758483105","301448692646058899207482760425218748756","94147435488430755371357534011398990316","229466013403722198256925836751087609493","27884497939278294395996060677791817696"],"threshold":0.9},"id":"CVE-2026-84447-e849eaa6","signature_type":"Line","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/30b52a4e829efe0ee6d7208e8500b99f664af5e9","target":{"file":"libheif/security_limits.h"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["203458221326664905798395552549443931088","70914572871016225525279932548996665574","188365730260226852536681875125574505730","115045800470902048179235937295583125840","84375422126016906880388178110803338309","221740437653866387059399241469289883980","122685078064139503786860170042137582219","182240959053844978136563058880148944304","199804516703902359573849147990745364996","305324342148720431246555203991522512548","131097988801622878126511748905277005635","201586085318704956264419930164379014895","156894032951645811044737037464904300123","334588761198569673194363285190106649743","149792131022802854731042742184159705254","258709430150231159882378200164834515519","39338683565843903291687966885007221243","47302972303553168154420518071793438972","211845142757588927931887496508346617196","285701682387856933710398624669416375476","10082134060675095348390301657505255128","185478642409937018983454223105821262586","200591300007062478093696082231025722347"],"threshold":0.9},"id":"CVE-2026-84447-f225426c","signature_type":"Line","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/30b52a4e829efe0ee6d7208e8500b99f664af5e9","target":{"file":"libheif/image-items/overlay.cc"}},{"deprecated":false,"digest":{"function_hash":"290376530547992955627823318514847174153","length":1003},"id":"CVE-2026-84447-f4392df9","signature_type":"Function","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/30b52a4e829efe0ee6d7208e8500b99f664af5e9","target":{"file":"libheif/image-items/overlay.cc","function":"ImageItem_Overlay::read_overlay_spec"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/30b52a4e829efe0ee6d7208e8500b99f664af5e9","target":{"file":"libheif/image-items/mask_image.cc"},"deprecated":false,"digest":{"line_hashes":["88121106918187081802291275175450249825","295307261426712535360024304580163020041","222895104460419287334360275504295270330","252192871431756287008897227601375483823"],"threshold":0.9},"id":"CVE-2026-84447-fa38b02d"}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-84447.json","vanir_signatures_modified":"2026-09-20T14:16:31Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}