CVE-2026-84447: libheif HEIF/AVIF Decoder DOS Vulnerability

CVE-2026-84447 Overview

CVE-2026-84447 is a denial-of-service vulnerability in libheif, an open-source HEIF and AVIF file format decoder and encoder. In versions 1.23.1 and earlier, crafted grid, iovl, and iden reference graphs can force the decoder to repeatedly decode the same base image. The processed_ids tracking set is copied per branch, and ImageItem::decode_image() lacks a shared operation budget across recursion. A single malicious file can therefore trigger exponential decode amplification and exhaust CPU and memory. The issue is tracked under [CWE-770] (Allocation of Resources Without Limits or Throttling) and is fixed in version 1.23.2.

Critical Impact
A remote, unauthenticated attacker can trigger resource exhaustion by supplying a crafted HEIF or AVIF file to any application that uses libheif for image decoding.

Affected Products

libheif versions 1.23.1 and earlier
Applications and services that embed libheif for HEIF/AVIF decoding
Downstream OS distributions and image processing pipelines packaging vulnerable libheif builds

Discovery Timeline

2026-09-18 - CVE-2026-84447 published to the National Vulnerability Database (NVD)
2026-09-18 - Last updated in NVD database
Fix released - Addressed in libheif v1.23.2 via GHSA-x8xm-cm2c-cfc8

Technical Details for CVE-2026-84447

Vulnerability Analysis

The HEIF and AVIF container formats support derived images that reference other items in the file. Reference types include grid images (grid), image overlays (iovl), and identity references (iden). libheif traverses these references recursively during decoding through ImageItem::decode_image().

The library tracks already-processed items using a processed_ids set to prevent cycles. However, this set was copied into each recursion branch rather than shared. As a result, sibling branches could each independently decode the same base image without observing prior work. A malicious reference graph exploits this to amplify a small file into millions of decode operations, causing CPU and memory exhaustion in the host process.

Root Cause

The root cause is missing resource throttling ([CWE-770]) in the derived-image traversal. ImageItem::decode_image() did not enforce a shared operation budget across recursion branches or parallel tile-decode threads. The per-branch copy of processed_ids prevented direct cycles but did not bound total work when many branches referenced the same targets.

Attack Vector

Exploitation is network-reachable and requires no authentication or user interaction beyond the target application processing the file. Any workflow that ingests attacker-controlled HEIF or AVIF content, such as web upload endpoints, email gateways, chat platforms, mobile messaging apps, or thumbnail generators, is exposed.

     return Error(heif_error_Invalid_input, heif_suberror_Nonexisting_item_referenced);
   }
 
-
-  auto decodingResult = imgitem->decode_image(options, decode_only_tile, tx, ty, processed_ids);
+  // Seed the traversal state for this top-level decode. The cycle-detection set
+  // is carried over from the caller; the amplification budget (shared across all
+  // recursion branches and parallel tile-decode threads) is created here, once.
+  // (GHSA-x8xm-cm2c-cfc8)
+  DecodeTraversalState decode_state;
+  decode_state.processed_ids = std::move(processed_ids);
+
+  const heif_security_limits* limits = get_security_limits();
+  if (limits && limits->max_items != 0) {
+    // Bound total sub-image decodes at a modest multiple of max_items. A
+    // well-formed file decodes each of its (<= max_items) items a small number
+    // of times, so this only trips on reference-amplification. Computed in 64
+    // bit and clamped to avoid overflow when max_items is configured very high.
+    uint64_t budget = static_cast<uint64_t>(limits->max_items) * MAX_DERIVED_IMAGE_DECODE_FACTOR;
+    decode_state.max_decodes = (budget > UINT32_MAX) ? UINT32_MAX : static_cast<uint32_t>(budget);
+    decode_state.max_overlay_nesting = MAX_OVERLAY_NESTING_LEVEL;
+    decode_state.decode_count = std::make_shared<std::atomic<uint32_t>>(0);
+  }
+
+  auto decodingResult = imgitem->decode_image(options, decode_only_tile, tx, ty, decode_state);
   if (!decodingResult) {
     return decodingResult.error();
   }

Source: libheif commit 30b52a4. The patch introduces a shared DecodeTraversalState with an atomic decode_count and an amplification budget derived from max_items, bounding total sub-image decodes across all branches.

Detection Methods for CVE-2026-84447

Indicators of Compromise

Process consuming abnormal CPU or memory while decoding an image file
Application crashes, timeouts, or out-of-memory kills correlated with HEIF or AVIF processing
HEIF or AVIF files containing unusually large numbers of grid, iovl, or iden derivation references relative to file size

Detection Strategies

Inventory dependencies on libheif and identify all applications, packages, and container images bundling versions at or below 1.23.1
Add file-format inspection at ingress points to flag HEIF/AVIF assets whose item reference counts exceed reasonable thresholds
Correlate image-processing worker crashes and OOM events with recent uploads or inbound messages carrying HEIF/AVIF payloads

Monitoring Recommendations

Alert on sustained CPU saturation or memory growth in image-processing services, thumbnailers, and transcoders
Monitor container and pod restart rates for services that decode user-supplied images
Log file hashes and metadata for HEIF/AVIF uploads to enable retrospective hunting once vulnerable payloads are identified

How to Mitigate CVE-2026-84447

Immediate Actions Required

Upgrade libheif to version 1.23.2 or later across all systems and container images
Rebuild and redeploy applications that statically link libheif after upgrading the library
Apply strict CPU, memory, and timeout limits to any process that decodes untrusted HEIF or AVIF content

Patch Information

The fix is delivered in libheif 1.23.2. The upstream commit 30b52a4 introduces a DecodeTraversalState shared across all recursion branches. It uses heif_security_limits::max_items multiplied by MAX_DERIVED_IMAGE_DECODE_FACTOR to compute a bounded budget for total sub-image decodes, tracked via an atomic counter. Additional details are in GHSA-x8xm-cm2c-cfc8.

Workarounds

Reduce the configured heif_security_limits::max_items value to constrain acceptable file complexity where patching is not immediately possible
Enforce per-request wall-clock timeouts and memory ceilings on image-decoding worker processes
Reject or pre-filter HEIF and AVIF files that exceed conservative limits on item count or reference depth at the application boundary

bash

# Configuration example: verify installed libheif version and constrain decoder workers
heif-info --version

# Example systemd hardening for an image-processing worker
# /etc/systemd/system/image-worker.service.d/limits.conf
[Service]
MemoryMax=512M
CPUQuota=50%
TimeoutStartSec=30