CVE-2026-84449: libheif Buffer Overflow Vulnerability

CVE-2026-84449 Overview

CVE-2026-84449 is an integer overflow vulnerability in libheif, a widely used HEIF and AVIF file format decoder and encoder. The flaw affects versions prior to 1.19.6 and resides in the Op_RGB24_32_to_YCbCr::convert_colorspace() function. When applications create extremely large RGB images through heif_image_create() and heif_image_add_plane(), the image-plane stride is stored in a 32-bit integer that can wrap around. The wrapped stride causes the color conversion loop in libheif/color-conversion/rgb2yuv.cc to compute an invalid input pointer, resulting in an out-of-bounds read [CWE-125] that crashes the encoding process.

Critical Impact
An attacker able to supply oversized RGB image dimensions to a libheif-backed encoder can trigger an out-of-bounds read that crashes heif_context_encode_image(), producing a denial-of-service condition.

Affected Products

libheif versions prior to 1.19.6
Applications and services that link against vulnerable libheif builds for HEIF or AVIF encoding
Image processing pipelines that expose heif_image_create() and heif_image_add_plane() to attacker-controlled dimensions

Discovery Timeline

2026-09-18 - CVE-2026-84449 published to the National Vulnerability Database (NVD)
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-84449

Vulnerability Analysis

The defect lives in libheif's RGB-to-YCbCr color conversion path. Op_RGB24_32_to_YCbCr::convert_colorspace() stores per-plane strides in a uint32_t value. For sufficiently large image widths, the byte-stride calculation exceeds the 32-bit range and wraps to a smaller value. The conversion loop then multiplies the wrapped stride by a Y coordinate to derive a source pointer inside the interleaved RGB plane.

Because the stride no longer represents the true row size, the derived pointer references memory outside the allocated buffer. libheif proceeds to read the fabricated address during pixel conversion, dereferencing memory it does not own. The resulting invalid read triggers a process crash inside heif_context_encode_image(). The issue does not corrupt memory or leak sensitive data, but it terminates the encoding process.

Root Cause

The root cause is an integer width mismatch. libheif's internal APIs and callers used uint32_t for stride values while row-index multiplication requires a wider type. The fix in commit e29953d promotes the stride type to size_t throughout the plane accessor APIs, eliminating the wrap.

Attack Vector

Exploitation requires an attacker to influence the RGB image dimensions passed to a libheif encoder. In a network-exposed service that accepts image geometry parameters or transcodes attacker-supplied images, a crafted request with extremely large width values triggers the overflow during encoding. The attack complexity is high because it requires very large allocations to reach the overflow threshold.

// Patch from libheif/api/libheif/heif.cc (commit e29953d)
// Stride type widened from uint32_t to size_t to prevent overflow
     return nullptr;
   }
 
-  uint32_t stride;
+  size_t stride;
   const auto* p = image->image->get_plane(channel, &stride);
 
   // TODO: use C++20 std::cmp_greater()
// Source: https://github.com/strukturag/libheif/commit/e29953da30eb11aa1762df0bff3b36be4b22fbe3

Detection Methods for CVE-2026-84449

Indicators of Compromise

Repeated crashes of processes or services that call heif_context_encode_image() when handling user-supplied images
Core dumps referencing Op_RGB24_32_to_YCbCr::convert_colorspace or libheif/color-conversion/rgb2yuv.cc frames
Inbound requests carrying HEIF or AVIF conversion jobs with unusually large declared image widths or heights

Detection Strategies

Inventory installed libheif versions across servers, containers, and desktop endpoints and flag any build older than 1.19.6
Enable AddressSanitizer or equivalent tooling in test environments to catch the out-of-bounds read during fuzzing of image workloads
Correlate application crash telemetry with recent image upload events to identify probing attempts

Monitoring Recommendations

Alert on abnormal termination of image conversion workers and pipeline job failures tied to HEIF or AVIF inputs
Log and review image dimensions submitted to conversion endpoints, particularly widths beyond legitimate application maximums
Track dependency manifests (SBOMs) for the libheif version pinned in downstream applications and containers

How to Mitigate CVE-2026-84449

Immediate Actions Required

Upgrade libheif to version 1.19.6 or later on all systems that decode or encode HEIF and AVIF content
Rebuild and redeploy any statically linked applications, containers, and OS packages that embed vulnerable libheif builds
Enforce maximum width and height limits on image inputs at the application layer to reject oversized geometry before it reaches libheif

Patch Information

The issue is fixed in libheif v1.19.6. The corrective change is documented in commit e29953d, which widens the internal stride type from uint32_t to size_t in plane accessor APIs. Full details are in GitHub Security Advisory GHSA-2c3g-p585-8rpq.

Workarounds

Reject image inputs that exceed practical maximum dimensions before invoking libheif encoding functions
Sandbox or isolate image conversion workers so that a crash does not affect the parent service
Disable HEIF and AVIF encoding paths temporarily where the format is not required by business logic

bash

# Verify installed libheif version and upgrade if below 1.19.6
pkg-config --modversion libheif

# Example: rebuild libheif from source at the patched tag
git clone https://github.com/strukturag/libheif.git
cd libheif
git checkout v1.19.6
mkdir build && cd build
cmake --preset=release ..
cmake --build .
sudo cmake --install .