{"id":"CVE-2026-84450","summary":"libheif: `clap` + oversized `ispe` aborts on an assert in `Fraction::Fraction` (incomplete fix for CVE-2026-62289)","details":"libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.3, a crafted image item containing a clap property and an ispe width or height greater than INT32_MAX + 1 can reach crop calculations through heif_image_handle_get_image_tiling(). Box_clap::left_rounded() or Box_clap::top_rounded() passes the image dimension minus one to Fraction::Fraction(), whose uint32_t constructor uses an assertion as input validation, causing assert-enabled builds to abort. Release builds can instead compute invalid crop geometry, and the tiling API returns dimensions that the normal decode security limits reject. This issue is fixed in version 1.23.3.","aliases":["GHSA-gh5q-69gg-c964"],"modified":"2026-09-20T14:16:33.457533Z","published":"2026-09-18T16:04:54.422Z","related":["openSUSE-SU-2026:11719-1"],"database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84450.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-617"]},"references":[{"type":"WEB","url":"https://github.com/strukturag/libheif/releases/tag/v1.23.3"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84450.json"},{"type":"ADVISORY","url":"https://github.com/strukturag/libheif/security/advisories/GHSA-gh5q-69gg-c964"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84450"},{"type":"FIX","url":"https://github.com/strukturag/libheif/commit/1c2df9c0e814f89716f3a4d85a444b2dbc63ad69"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/strukturag/libheif","events":[{"introduced":"c4e4657dcf6bcc06e934632f97736f7c78dbff9e"},{"fixed":"1c2df9c0e814f89716f3a4d85a444b2dbc63ad69"},{"fixed":"78c9746aea226b22885e8d35241353ce669c4ea5"}],"database_specific":{"extracted_events":[{"introduced":"1.19.0"},{"fixed":"1.23.3"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["v1.23.2","v1.23.1","v1.23.0","v1.22.2","v1.22.1","v1.22.0","v1.21.2","v1.21.1","v1.21.0","v1.20.1","v1.20.0","v1.19.5","v1.19.4","v1.19.3","v1.19.2","v1.19.1","v1.19.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-84450.json","vanir_signatures_modified":"2026-09-20T14:16:33Z","vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"170352982320314727288744613012883382006","length":146},"id":"CVE-2026-84450-00653c60","signature_type":"Function","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/1c2df9c0e814f89716f3a4d85a444b2dbc63ad69","target":{"file":"libheif/box.cc","function":"Box_clap::bottom_rounded"}},{"signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/1c2df9c0e814f89716f3a4d85a444b2dbc63ad69","target":{"file":"libheif/image-items/image_item.cc","function":"ImageItem::process_image_transformations_on_tiling"},"deprecated":false,"digest":{"function_hash":"84801817531525487812441398826197265663","length":2617},"id":"CVE-2026-84450-06236585","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"117766026511850685951781439275022328858","length":2939},"id":"CVE-2026-84450-080503c9","signature_type":"Function","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/1c2df9c0e814f89716f3a4d85a444b2dbc63ad69","target":{"file":"libheif/image-items/image_item.cc","function":"ImageItem::encode_to_bitstream_and_boxes"}},{"deprecated":false,"digest":{"function_hash":"234639112024092236682206552516297962959","length":386},"id":"CVE-2026-84450-131aecaa","signature_type":"Function","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/1c2df9c0e814f89716f3a4d85a444b2dbc63ad69","target":{"file":"libheif/box.cc","function":"Box_clap::set"}},{"deprecated":false,"digest":{"function_hash":"9871523502093639542826212795670247503","length":814},"id":"CVE-2026-84450-197eb665","signature_type":"Function","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/1c2df9c0e814f89716f3a4d85a444b2dbc63ad69","target":{"file":"libheif/api/libheif/heif_regions.cc","function":"heif_region_get_ellipse_transformed"}},{"deprecated":false,"digest":{"function_hash":"92223832002201552232050025727754881407","length":2084},"id":"CVE-2026-84450-1af49e76","signature_type":"Function","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/1c2df9c0e814f89716f3a4d85a444b2dbc63ad69","target":{"file":"libheif/region.cc","function":"RegionCoordinateTransform::create"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/1c2df9c0e814f89716f3a4d85a444b2dbc63ad69","target":{"file":"tests/clap_zero_size.cc"},"deprecated":false,"digest":{"line_hashes":["268251884144407872354344751837669957540","19267534886406717470654700654875607406","108209307826903591192771400051484023379","45187466633410220095813558090047452710","64954764387705636606795003830481280355","87720207547153422768807851370000558808","183661222707906792760375897021443508722"],"threshold":0.9},"id":"CVE-2026-84450-31f84fe5"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/1c2df9c0e814f89716f3a4d85a444b2dbc63ad69","target":{"file":"libheif/box.h"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["81189473444326824340458853501704986032","290054077854075238905556077258116230744","272388574348505325694056442565850308590","215164151527817340277731745962709264302","280817345144013038310304765868077619359","264579947815058985105978025620651319471","44135028219028384334168273590313734239","217771455442337385368486223602406153430","294007344696754108385288616715820776665","201652904324723977724354857783643853268","119109811055955452149630180842911811047","268794617575005519526361858942920665201","17807591767525866418346977461390185117","198401051491998695954210789155503600424","29315864598603023041304740458877134028","261567503662376788771487805015530713264","266701854624498069049022107772793441114"]},"id":"CVE-2026-84450-3ae38d47"},{"id":"CVE-2026-84450-427f8888","signature_type":"Line","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/1c2df9c0e814f89716f3a4d85a444b2dbc63ad69","target":{"file":"libheif/api/libheif/heif_regions.cc"},"deprecated":false,"digest":{"line_hashes":["5418321465095265478569633563467558857","259012962753716251949474718471312250437","235395909871356389755057843015152017710","20537228470261346156102192669510588305","240832115920901628516429567008603646419","87217171356428626415554221515175935732","119833364548873398272556252897698933330","152455637982621609680230557109091611024","248782263335093579476082308676407354195","141297713827942371433672872199945885489","247502477714191923632438729670534965209","132792040648293469141744351897865501469","331773948349549407126851596160435338743","270859120036307983643189890762083303273","218308362795402195851732438985599455369","272877390717777897910329198943701316105","338688213747510562807225534683305216247","259194024724644496508937570211511597521","280580526226534798158850714783465056322","88830031508326288178383413214283072463","110546032103053653369599755084243426288","192932742315935615677887287017419051496"],"threshold":0.9}},{"signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/1c2df9c0e814f89716f3a4d85a444b2dbc63ad69","target":{"file":"libheif/box.cc","function":"Box_clap::parse"},"deprecated":false,"digest":{"function_hash":"115052579700747108629740484593402429345","length":1376},"id":"CVE-2026-84450-4caa3509","signature_type":"Function"},{"source":"https://github.com/strukturag/libheif/commit/1c2df9c0e814f89716f3a4d85a444b2dbc63ad69","target":{"file":"libheif/region.cc"},"deprecated":false,"digest":{"line_hashes":["75768431014019583542610806694366551045","315267201307178945931250154271779794888","58655109019694648157443446996324435832","208387783826684028194442685135619277050","99852781864429145549068977945461339001","161350378894856962815505270262247688208","10076131181781702535982188766250202697","250571638470768017642895330977346685827","185306094591504422021267062625832586007","213049373124272519614784489828686709649","6727680464017157358322224783246585527","308087949976358374500596800063281442744","155009477980197024259718029821667139567","330020505250092262218496724235738172","88497066675897404395645591465385376341","139787972436352344168938234074053572283","187243365223476472153325580936612525635","104507956059143900084904810320873684327","178137138070954540560058917045076918109","328096377236770504647867170327220913851","260322166541824208558891208079525664873","71516567050548733271756388613386294848"],"threshold":0.9},"id":"CVE-2026-84450-5ca621aa","signature_type":"Line","signature_version":"v1"},{"target":{"file":"libheif/api/libheif/heif_tiling.cc","function":"heif_image_handle_get_image_tiling"},"deprecated":false,"digest":{"function_hash":"226281592052854783402400051023189359122","length":398},"id":"CVE-2026-84450-64c9fbed","signature_type":"Function","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/1c2df9c0e814f89716f3a4d85a444b2dbc63ad69"},{"signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/1c2df9c0e814f89716f3a4d85a444b2dbc63ad69","target":{"file":"libheif/api/libheif/heif_regions.cc","function":"heif_region_get_point_transformed"},"deprecated":false,"digest":{"function_hash":"33795872010128422694317154617910030952","length":687},"id":"CVE-2026-84450-66468b77","signature_type":"Function"},{"signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/1c2df9c0e814f89716f3a4d85a444b2dbc63ad69","target":{"file":"libheif/region.h"},"deprecated":false,"digest":{"line_hashes":["1620407910751266711527282911832938461","30360575787415355202778462960736239805","162481910685423117407119838585916674354","260175152649542120922987689577727572599","79721250498196463561547401690412453669","88532202264208914842142529763227260860"],"threshold":0.9},"id":"CVE-2026-84450-96a2be48","signature_type":"Line"},{"signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/1c2df9c0e814f89716f3a4d85a444b2dbc63ad69","target":{"file":"libheif/api/libheif/heif_regions.cc","function":"heif_region_get_rectangle_transformed"},"deprecated":false,"digest":{"function_hash":"173342332708576643359912167084448522355","length":816},"id":"CVE-2026-84450-99c77cdb","signature_type":"Function"},{"deprecated":false,"digest":{"line_hashes":["236922279648934148498209350462913887240","260568174343338832383123980275912300892","75580580013720514715796736988271806700","168356881211803960394494910375257351728","278204006449381252902192728356694539708","80379540296786899784438874204814527794","132405858996581144547809092241362333337","137895032315613481085067895365715089590","180452750203230654054655874423646322115","282978447995748836415190164824690185822","168005983343164709382259941041959431623","313065910502871695471982329652715414763","233602455365691503193809259878254078307","322258306231309156838006648504686633390","338613923013095232988527203545707756029","135175672422006490053953874498450566153","162512066392837427684140200557298936668","317559882751098652949094678886316364914","233769209111848154981591747780733913697","196478367281649555833495760677933041891","70338079347168111913964481073018192800","190500279469912681091854207129127695223","50723676690701298631785753164558872213","303399589947413558088876673363998189569","318140242263332858001500059686417459161","305506450374261850448097359477881603035","267895950008994570245964549195396493487","312557045952330308134158369311700968897","167221870312870160720703876364235059382","322076347100717720930543387748006479239","278567870706414271664590940579929829625","180031383472153806310311575322768412838","118608755182894771593238688242452839195","246400664116971424032054689724697744809","2505293888281333613865936768202015576","6261990847521115582968049546045185865","51455195865036997988602728799243608872","326915013791054243547432503433622917184","153729638320053135328296334236067242000","90140357598432249738546575993872355906","211133844083948072302587859101202437726","322093143448675408774094690647934401268","53289225644107102573701179285439902267","236861530612275708280587069914112295856","284149050971797366185658952097751281743","2264603734956223602784356224446684918","284401661024955786536687095469253823178","151586271326732800389454718483207821948","38503335020981498304074474397911877455","127466909818953668680143725322511619919","63510088722548834880820910870508870760","115791991165718696774003690431400132626","137324010870943696606616554403493641517","129057926945955871604546263559235916335","254162138698785018426550673615504218046","100154482184491145615330199543367105297","259375898483926044363976607405920957462","107930797245492306137662055010107730183","162689260716832606758007298521944251986","107098684136677834796365866789217642588","156051523067819366195009669116061492682","310821604170404302630282266644526591144","239675398904151654836294821723956611432","283023098752367401625163270827852760621","84700461003980936629658472822921007747","146092791380030021858017709407161221492","1871298624368751537322961729142709359","295518686231379152901312003834874823607","25041927548733113384627768728369932285","258253922833771847836691976905288350166","117836751211686569589506989616774897077","310646063803642230739295486102812734659","61353234701788143440838430817484829187","29578106650027953200504734942791170574"],"threshold":0.9},"id":"CVE-2026-84450-9d8f7fc8","signature_type":"Line","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/1c2df9c0e814f89716f3a4d85a444b2dbc63ad69","target":{"file":"libheif/box.cc"}},{"digest":{"line_hashes":["4583417437710926930468605614900546938","232171452795770586015451598601168802077","64579285460667564020485186516787524914","109445100049471951260472609636036737250","52405684407377087192831297028306196279","290487665071308142251048831924740904816","45009966382512091080624109168070623236","320164014037425194526400535339301184561","118082096661667247503456853607901743196","185356460945763674859572200957011742309","153113085911562452789876304402160014779","10477052147127239252484342186614998862","7963387667293819145035636941434163476","83912639743144115208549770672868318723","299469557644804427096511839740945331294","267462630300837346010039413190878347023","18102854472683722621156363421954992063","707032944084462745897715379281703634","57780416748452158382954541684193069648","205279754274402199517966393705742451586","180094309569076931671217717668101861781"],"threshold":0.9},"id":"CVE-2026-84450-a3e6c9ca","signature_type":"Line","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/1c2df9c0e814f89716f3a4d85a444b2dbc63ad69","target":{"file":"libheif/image-items/image_item.cc"},"deprecated":false},{"id":"CVE-2026-84450-c4cf91a7","signature_type":"Function","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/1c2df9c0e814f89716f3a4d85a444b2dbc63ad69","target":{"file":"libheif/api/libheif/heif_properties.cc","function":"heif_item_get_property_transform_crop_borders"},"deprecated":false,"digest":{"function_hash":"180750236809002837996667228347311700936","length":535}},{"digest":{"line_hashes":["160180322166677618717905025863552746813","229575095542331847900879582619104587338","314698629152800298130010615086811568683","321994066647726159154681188024222927967","37816035830277043237840213206762205407","306335721058643443031086489946249531557","114692023988093182583607667186837110260"],"threshold":0.9},"id":"CVE-2026-84450-c5909e54","signature_type":"Line","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/1c2df9c0e814f89716f3a4d85a444b2dbc63ad69","target":{"file":"libheif/api/libheif/heif_tiling.cc"},"deprecated":false},{"source":"https://github.com/strukturag/libheif/commit/1c2df9c0e814f89716f3a4d85a444b2dbc63ad69","target":{"file":"libheif/box.cc","function":"Box_clap::top_rounded"},"deprecated":false,"digest":{"function_hash":"317255491326053409063057665346416783464","length":229},"id":"CVE-2026-84450-c70fc930","signature_type":"Function","signature_version":"v1"},{"target":{"file":"libheif/api/libheif/heif_regions.cc","function":"heif_region_get_poly_points_scaled"},"deprecated":false,"digest":{"function_hash":"105514758265391519493756472185271432138","length":804},"id":"CVE-2026-84450-e691edb7","signature_type":"Function","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/1c2df9c0e814f89716f3a4d85a444b2dbc63ad69"},{"target":{"file":"libheif/image-items/image_item.cc","function":"ImageItem::decode_image"},"deprecated":false,"digest":{"function_hash":"297387927326230468102578267438763705771","length":7002},"id":"CVE-2026-84450-f17d2249","signature_type":"Function","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/1c2df9c0e814f89716f3a4d85a444b2dbc63ad69"},{"signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/1c2df9c0e814f89716f3a4d85a444b2dbc63ad69","target":{"file":"libheif/api/libheif/heif_properties.cc"},"deprecated":false,"digest":{"line_hashes":["117341716191190216891665852068886387535","80283016106231770685051696298403568118","111066827610544351763006848820853273481","290269113211922118813893700489794807064","98170933358179318930673513558676570007","70064461063123673005148343358236127090","267096856607624497503160459531039463338"],"threshold":0.9},"id":"CVE-2026-84450-f2aeeac9","signature_type":"Line"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/1c2df9c0e814f89716f3a4d85a444b2dbc63ad69","target":{"file":"libheif/box.cc","function":"Box_clap::left_rounded"},"deprecated":false,"digest":{"function_hash":"220247447481347047988528273240694770125","length":236},"id":"CVE-2026-84450-f42c2754"},{"id":"CVE-2026-84450-fccf0f79","signature_type":"Function","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/1c2df9c0e814f89716f3a4d85a444b2dbc63ad69","target":{"file":"libheif/box.cc","function":"Box_clap::right_rounded"},"deprecated":false,"digest":{"length":144,"function_hash":"71719244247777127114217807071496421483"}},{"signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/1c2df9c0e814f89716f3a4d85a444b2dbc63ad69","target":{"file":"libheif/box.cc","function":"Fraction::Fraction"},"deprecated":false,"digest":{"function_hash":"268463736170740840470419419484748167708","length":274},"id":"CVE-2026-84450-fd65e55e","signature_type":"Function"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"}]}