CVE-2026-84384

libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.2, crafted HEIF or AVIF mime metadata and unci image data can cause decompress_brotli() and do_inflate() to grow accumulated output without an effective size limit or MemoryHandle accounting. The brotli path has no output bound, while the zlib path checks only a small temporary buffer in a branch that valid streams do not reach, and overlapping icef units can decompress the same payload repeatedly. HeifContext::interpret_heif_file_images() processes multiple compressed metadata items during file opening, allowing a small file to consume unbounded memory and terminate the process. This issue is fixed in version 1.23.2.

These are all security issues fixed in the gdk-pixbuf-loader-libheif-1.23.4-1.1 package on the GA media of openSUSE Tumbleweed.

This update for libheif fixes the following issues:

• CVE-2026-84383: Heap buffer overflow in scale_nearest_neighbor() via duplicate alpha planes from nested iden/auxl items (bsc#1279443).
• CVE-2026-84384: brotli/zlib decompression paths lack output-size limits, allowing decompression-bomb OOM/DoS (bsc#1279445).
• CVE-2026-84444: Out-of-bounds write in the unci encoder (bsc#1279448).
• CVE-2026-84446: Sequence decode timing-table initialization allows non-terminating loops and unbounded memory, bypassing max_sequence_frames (bsc#1279447).
• CVE-2026-84447: Derived-image indirect reference chains and tiled offsets bypass decode caching and MemoryHandle limits, causing CPU/memory amplification DoS (bsc#1279446).
• CVE-2026-84448: Heap out-of-bounds read in the inline-mask region API (bsc#1279449).
• CVE-2026-84450: image item with clap property and an ispe declaring a dimension greater than INT32_MAX + 1 can lead to a crash via an abort (bsc#1280002).
• CVE-2026-84451: crafted HEIF file advertising a 4096 � 4096 uncompressed tile grid can cause an out-of-bounds read due to an integer overflow (bsc#1280001).
• Heap out-of-bounds write in the uncompressed encoder for RRGGBB images with interleaved bit-depth <= 8 (bsc#1273083).
• Out-of-bounds read and write in derived-item and pixel-plane handling (bsc#1279444).

Changes for libheif:

• Update to version 1.23.4:

• CVE-2026-XXXXX: The max_items security limit was not enforced for the child boxes of iinf, so a file could declare an unbounded number of items.
• CVE-2026-XXXXX: Unbounded recursion in the reference-cycle check crashed the parser on a long chain of derived items, without bound when the item-count limit is disabled.
• CVE-2026-XXXXX: Permanent decoder deadlock through a lock-order inversion in parallel grid tile decoding (enabled by default).
• CVE-2026-XXXXX: Heap out-of-bounds read in the encoder pluginsi for images whose luma and chroma bit depths differ.
• CVE-2026-XXXXX: Unreclaimable memory leak in heif_track_get_next_raw_sequence_sample().
• CVE-2026-XXXXX: Heap out-of-bounds read in the WebCodecs decoder plugin

• includes fixes from 1.23.3:

• CVE-2026-XXXXX: Heap buffer overflow (write) in the uncompressed (unci) mixed-interleave decoder when the two chroma components declare different bit depths.
• CVE-2026-XXXXX: Permanent decoder deadlock through a reference cycle between an image and its alpha auxiliary image.
• CVE-2026-XXXXX: Heap out-of-bounds read in the YCbCr 4:2:0 to 16-bit interleaved RGB conversion when the chroma planes have a lower bit depth than luma
• CVE-2026-XXXXX: Heap buffer overflow in the SVT-AV1 encoder plugin when encoding a high-bit-depth alpha channel, and a double free on its send-picture error path.
• CVE-2026-84451: Incomplete fix: the tile range check of the unci decoder (without icef) could still overflow, allowing an out-of-bounds read
• CVE-2026-XXXXX: Heap out-of-bounds read when converting odd- height 4:2:0 frames of an uncompressed (uncv) image sequence to RGB.
• CVE-2026-XXXXX: Out-of-bounds read in the RGB to YCbCr identity- matrix color conversion when the R, G, and B planes have different bit depths
• CVE-2026-84450: A clap property combined with an oversized ispe reached an assert() in the Fraction arithmetic and aborted the process (incomplete fix). An error is returned instead.
• Fix Several smaller findings
• Fix Undefined behavior (negative shift) in the HDR bit-depth up-conversion for target bit depths above 16. Such conversions are now rejected.
• A number of bug fixes

• Update to version 1.23.2: [jsc#PED-16355]

• CVE-2026-84383: Heap buffer overflow in scale_nearest_neighbor() via duplicate alpha planes from nested iden/auxl items. (boo#CVE-2026-84383)
• Out-of-bounds read and write in derived-item and pixel-plane handling. Through iden and auxl item chains, a crafted file could attach pixel planes whose size differs from the image geometry; crop,…

Root has patched CVE-2026-84384 in the libheif package for Root:Debian:12. Multiple fixed versions available.

Root has patched CVE-2026-84384 in the libheif package for Root:Debian:13. Multiple fixed versions available.

This update for libheif fixes the following issues:

• CVE-2026-84383: Heap buffer overflow in scale_nearest_neighbor() via duplicate alpha planes from nested iden/auxl items (bsc#1279443).
• CVE-2026-84384: brotli/zlib decompression paths lack output-size limits, allowing decompression-bomb OOM/DoS (bsc#1279445).
• CVE-2026-84444: Out-of-bounds write in the unci encoder (bsc#1279448).
• CVE-2026-84446: Sequence decode timing-table initialization allows non-terminating loops and unbounded memory, bypassing max_sequence_frames (bsc#1279447).
• CVE-2026-84447: Derived-image indirect reference chains and tiled offsets bypass decode caching and MemoryHandle limits, causing CPU/memory amplification DoS (bsc#1279446).
• CVE-2026-84448: Heap out-of-bounds read in the inline-mask region API (bsc#1279449).
• CVE-2026-84450: image item with clap property and an ispe declaring a dimension greater than INT32_MAX + 1 can lead to a crash via an abort (bsc#1280002).
• CVE-2026-84451: crafted HEIF file advertising a 4096 x 4096 uncompressed tile grid can cause an out-of-bounds read due to an integer overflow (bsc#1280001).
• Out-of-bounds read and write in derived-item and pixel-plane handling (bsc#1279444).

Changes for libheif:

• Update to version 1.23.4 (jsc#PED-16355)

Yuqi Qiu and Xiang Li discovered that libheif incorrectly handled certain compressed metadata. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-84384)

Yuqi Qiu and Xiang Li discovered that libheif incorrectly handled certain HEIF sequence data. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-84446)

Yuqi Qiu and Xiang Li discovered that libheif incorrectly handled certain image references. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-84447)

It was discovered that libheif incorrectly handled certain region masks. A local attacker could possibly use this issue to obtain sensitive information or cause a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-84448)

It was discovered that libheif incorrectly handled certain images. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. (CVE-2026-84449)