CVE-2026-84444

libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, when WITH_UNCOMPRESSED_CODEC is enabled, heif_context_add_image_tile() accepts an independently constructed tile whose component-plane dimensions do not match the tile geometry established by the prototype image. ImageItem_uncompressed::add_image_tile() passes that tile directly to unc_encoder::encode_tile(), which lacked the check_component_sizes() gate and sizes its output from the configured tile geometry while copying the tile's actual component-plane dimensions. An oversized component plane can therefore make unc_encoder_component_interleave::encode_tile() copy attacker-controlled data beyond the heap output buffer. This issue is fixed in version 1.23.2.

These are all security issues fixed in the gdk-pixbuf-loader-libheif-1.23.4-1.1 package on the GA media of openSUSE Tumbleweed.

This update for libheif fixes the following issues:

• CVE-2026-84383: Heap buffer overflow in scale_nearest_neighbor() via duplicate alpha planes from nested iden/auxl items (bsc#1279443).
• CVE-2026-84384: brotli/zlib decompression paths lack output-size limits, allowing decompression-bomb OOM/DoS (bsc#1279445).
• CVE-2026-84444: Out-of-bounds write in the unci encoder (bsc#1279448).
• CVE-2026-84446: Sequence decode timing-table initialization allows non-terminating loops and unbounded memory, bypassing max_sequence_frames (bsc#1279447).
• CVE-2026-84447: Derived-image indirect reference chains and tiled offsets bypass decode caching and MemoryHandle limits, causing CPU/memory amplification DoS (bsc#1279446).
• CVE-2026-84448: Heap out-of-bounds read in the inline-mask region API (bsc#1279449).
• CVE-2026-84450: image item with clap property and an ispe declaring a dimension greater than INT32_MAX + 1 can lead to a crash via an abort (bsc#1280002).
• CVE-2026-84451: crafted HEIF file advertising a 4096 � 4096 uncompressed tile grid can cause an out-of-bounds read due to an integer overflow (bsc#1280001).
• Heap out-of-bounds write in the uncompressed encoder for RRGGBB images with interleaved bit-depth <= 8 (bsc#1273083).
• Out-of-bounds read and write in derived-item and pixel-plane handling (bsc#1279444).

Changes for libheif:

• Update to version 1.23.4:

• CVE-2026-XXXXX: The max_items security limit was not enforced for the child boxes of iinf, so a file could declare an unbounded number of items.
• CVE-2026-XXXXX: Unbounded recursion in the reference-cycle check crashed the parser on a long chain of derived items, without bound when the item-count limit is disabled.
• CVE-2026-XXXXX: Permanent decoder deadlock through a lock-order inversion in parallel grid tile decoding (enabled by default).
• CVE-2026-XXXXX: Heap out-of-bounds read in the encoder pluginsi for images whose luma and chroma bit depths differ.
• CVE-2026-XXXXX: Unreclaimable memory leak in heif_track_get_next_raw_sequence_sample().
• CVE-2026-XXXXX: Heap out-of-bounds read in the WebCodecs decoder plugin

• includes fixes from 1.23.3:

• CVE-2026-XXXXX: Heap buffer overflow (write) in the uncompressed (unci) mixed-interleave decoder when the two chroma components declare different bit depths.
• CVE-2026-XXXXX: Permanent decoder deadlock through a reference cycle between an image and its alpha auxiliary image.
• CVE-2026-XXXXX: Heap out-of-bounds read in the YCbCr 4:2:0 to 16-bit interleaved RGB conversion when the chroma planes have a lower bit depth than luma
• CVE-2026-XXXXX: Heap buffer overflow in the SVT-AV1 encoder plugin when encoding a high-bit-depth alpha channel, and a double free on its send-picture error path.
• CVE-2026-84451: Incomplete fix: the tile range check of the unci decoder (without icef) could still overflow, allowing an out-of-bounds read
• CVE-2026-XXXXX: Heap out-of-bounds read when converting odd- height 4:2:0 frames of an uncompressed (uncv) image sequence to RGB.
• CVE-2026-XXXXX: Out-of-bounds read in the RGB to YCbCr identity- matrix color conversion when the R, G, and B planes have different bit depths
• CVE-2026-84450: A clap property combined with an oversized ispe reached an assert() in the Fraction arithmetic and aborted the process (incomplete fix). An error is returned instead.
• Fix Several smaller findings
• Fix Undefined behavior (negative shift) in the HDR bit-depth up-conversion for target bit depths above 16. Such conversions are now rejected.
• A number of bug fixes

• Update to version 1.23.2: [jsc#PED-16355]

• CVE-2026-84383: Heap buffer overflow in scale_nearest_neighbor() via duplicate alpha planes from nested iden/auxl items. (boo#CVE-2026-84383)
• Out-of-bounds read and write in derived-item and pixel-plane handling. Through iden and auxl item chains, a crafted file could attach pixel planes whose size differs from the image geometry; crop,…

Root has patched CVE-2026-84444 in the libheif package for Root:Debian:12. Multiple fixed versions available.

Root has patched CVE-2026-84444 in the libheif package for Root:Debian:13. Multiple fixed versions available.

This update for libheif fixes the following issues:

• CVE-2026-84383: Heap buffer overflow in scale_nearest_neighbor() via duplicate alpha planes from nested iden/auxl items (bsc#1279443).
• CVE-2026-84384: brotli/zlib decompression paths lack output-size limits, allowing decompression-bomb OOM/DoS (bsc#1279445).
• CVE-2026-84444: Out-of-bounds write in the unci encoder (bsc#1279448).
• CVE-2026-84446: Sequence decode timing-table initialization allows non-terminating loops and unbounded memory, bypassing max_sequence_frames (bsc#1279447).
• CVE-2026-84447: Derived-image indirect reference chains and tiled offsets bypass decode caching and MemoryHandle limits, causing CPU/memory amplification DoS (bsc#1279446).
• CVE-2026-84448: Heap out-of-bounds read in the inline-mask region API (bsc#1279449).
• CVE-2026-84450: image item with clap property and an ispe declaring a dimension greater than INT32_MAX + 1 can lead to a crash via an abort (bsc#1280002).
• CVE-2026-84451: crafted HEIF file advertising a 4096 x 4096 uncompressed tile grid can cause an out-of-bounds read due to an integer overflow (bsc#1280001).
• Out-of-bounds read and write in derived-item and pixel-plane handling (bsc#1279444).

Changes for libheif:

• Update to version 1.23.4 (jsc#PED-16355)