{"id":"CVE-2026-84383","aliases":["BELL-CVE-2026-84383","DEBIAN-CVE-2026-84383","EUVD-2026-83019","GHSA-g89c-p67h-r497","SUSE-SU-2026:4276-1","UBUNTU-CVE-2026-84383","openSUSE-SU-2026:11719-1","openSUSE-SU-2026:21889-1"],"status":"published","title":"libheif: Heap buffer overflow in `scale_nearest_neighbor()` via duplicate Alpha planes from nested `iden`/`auxl` items","description":"libheif is a HEIF and AVIF file format decoder and encoder. From 1.22.0 until 1.23.2, a crafted HEIF, HEIC, or AVIF item graph using nested iden and auxl references can make HeifPixelImage::transfer_channel_from_image_as() append duplicate Alpha planes with different bit depths to m_storage. HeifPixelImage::scale_nearest_neighbor() in libheif/image/pixelimage.cc allocates the destination Alpha plane using the first plane's 8-bit depth, then iterates a later 10-bit or 12-bit Alpha component and writes uint16_t samples into the same 8-bit allocation. The output geometry controls the overflow extent and the encoded sample values control the data written, allowing a remote file processed by heif_decode_image() to cause a heap out-of-bounds write. This issue is fixed in version 1.23.2.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00717,"percentile":0.5426,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-787"],"published":"2026-09-04T00:00:00Z","modified":"2026-10-28T11:18:48Z","exploits":[{"source":"pocgithub","id":"dinosn/libheif-cve-2026-84383-lab","title":"dinosn/libheif-cve-2026-84383-lab","date":"2026-09-29","url":"https://github.com/dinosn/libheif-cve-2026-84383-lab"},{"source":"pocgithub","id":"sachincool/cve-2026-84383-poc","title":"sachincool/cve-2026-84383-poc","date":"2026-10-28","url":"https://github.com/sachincool/cve-2026-84383-poc"}],"fixes":[{"ecosystem":"Alpaquita:stream","package":"libheif","fixed_in":["1.23.4-r0"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libheif","fixed_in":["1.23.2-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpaquita:stream","package":"libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.20.2-r2"},{"fixed":"1.23.4-r0"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.2-1"}]}],"versions":["1.19.8-1","1.20.1-1","1.20.2-1","1.20.2-2","1.21.2-1","1.21.2-2","1.21.2-3","1.21.2-4","1.23.1-1"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP7","package":"libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.4-150700.3.21.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.4-150700.3.21.1"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.4-1.1"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.4-160000.1.1"}]}],"bundled":8}],"products":[{"vendor":"strukturag","product":"libheif"}],"references":[{"url":"https://github.com/strukturag/libheif/security/advisories/GHSA-g89c-p67h-r497","tags":["x_refsource_CONFIRM","exploit","advisory","report"]},{"url":"https://github.com/strukturag/libheif/commit/f4fb8bde4704ebb46e46ff9fb94407c9774153b2","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/strukturag/libheif/releases/tag/v1.23.2","tags":["x_refsource_MISC","web"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-84383","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84383.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84383","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-84383","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264276-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1279443","tags":["report"]},{"url":"https://bugzilla.suse.com/1279444","tags":["report"]},{"url":"https://bugzilla.suse.com/1279445","tags":["report"]},{"url":"https://bugzilla.suse.com/1279446","tags":["report"]},{"url":"https://bugzilla.suse.com/1279447","tags":["report"]},{"url":"https://bugzilla.suse.com/1279448","tags":["report"]},{"url":"https://bugzilla.suse.com/1279449","tags":["report"]},{"url":"https://bugzilla.suse.com/1280001","tags":["report"]},{"url":"https://bugzilla.suse.com/1280002","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84383","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84384","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84444","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84446","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84447","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84448","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84450","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84451","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-84383","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84383","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1273083","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-84383","title":"libheif: Heap buffer overflow in `scale_nearest_neighbor()` via duplicate Alpha planes from nested `iden`/`auxl` items","description":"libheif is a HEIF and AVIF file format decoder and encoder. From 1.22.0 until 1.23.2, a crafted HEIF, HEIC, or AVIF item graph using nested iden and auxl references can make HeifPixelImage::transfer_channel_from_image_as() append duplicate Alpha planes with different bit depths to m_storage. HeifPixelImage::scale_nearest_neighbor() in libheif/image/pixelimage.cc allocates the destination Alpha plane using the first plane's 8-bit depth, then iterates a later 10-bit or 12-bit Alpha component and writes uint16_t samples into the same 8-bit allocation. The output geometry controls the overflow extent and the encoded sample values control the data written, allowing a remote file processed by heif_decode_image() to cause a heap out-of-bounds write. This issue is fixed in version 1.23.2.","status":"published","published":"2026-09-18T15:55:46.914Z","modified":"2026-09-18T16:11:18.781Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:20:08.734143Z"}],"euvd":[{"id":"EUVD-2026-83019","description":"libheif is a HEIF and AVIF file format decoder and encoder. From 1.22.0 until 1.23.2, a crafted HEIF, HEIC, or AVIF item graph using nested iden and auxl references can make HeifPixelImage::transfer_channel_from_image_as() append duplicate Alpha planes with different bit depths to m_storage. HeifPixelImage::scale_nearest_neighbor() in libheif/image/pixelimage.cc allocates the destination Alpha plane using the first plane's 8-bit depth, then iterates a later 10-bit or 12-bit Alpha component and writes uint16_t samples into the same 8-bit allocation. The output geometry controls the overflow extent and the encoded sample values control the data written, allowing a remote file processed by heif_decode_image() to cause a heap out-of-bounds write. This issue is fixed in version 1.23.2.","status":"published","published":"2026-09-18T15:55:46Z","modified":"2026-09-18T16:11:18Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T17:28:08.412343Z"}],"nvd":[{"id":"CVE-2026-84383","description":"libheif is a HEIF and AVIF file format decoder and encoder. From 1.22.0 until 1.23.2, a crafted HEIF, HEIC, or AVIF item graph using nested iden and auxl references can make HeifPixelImage::transfer_channel_from_image_as() append duplicate Alpha planes with different bit depths to m_storage. HeifPixelImage::scale_nearest_neighbor() in libheif/image/pixelimage.cc allocates the destination Alpha plane using the first plane's 8-bit depth, then iterates a later 10-bit or 12-bit Alpha component and writes uint16_t samples into the same 8-bit allocation. The output geometry controls the overflow extent and the encoded sample values control the data written, allowing a remote file processed by heif_decode_image() to cause a heap out-of-bounds write. This issue is fixed in version 1.23.2.","status":"published","published":"2026-09-18T16:17:11.707Z","modified":"2026-09-18T16:17:11.853Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:12:49.70655Z"}],"osv":[{"id":"BELL-CVE-2026-84383","status":"published","published":"2026-09-08T06:05:20.869898Z","modified":"2026-10-02T07:15:05.460619522Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:26.341144Z"},{"id":"CVE-2026-84383","title":"libheif: Heap buffer overflow in `scale_nearest_neighbor()` via duplicate Alpha planes from nested `iden`/`auxl` items","description":"libheif is a HEIF and AVIF file format decoder and encoder. From 1.22.0 until 1.23.2, a crafted HEIF, HEIC, or AVIF item graph using nested iden and auxl references can make HeifPixelImage::transfer_channel_from_image_as() append duplicate Alpha planes with different bit depths to m_storage. HeifPixelImage::scale_nearest_neighbor() in libheif/image/pixelimage.cc allocates the destination Alpha plane using the first plane's 8-bit depth, then iterates a later 10-bit or 12-bit Alpha component and writes uint16_t samples into the same 8-bit allocation. The output geometry controls the overflow extent and the encoded sample values control the data written, allowing a remote file processed by heif_decode_image() to cause a heap out-of-bounds write. This issue is fixed in version 1.23.2.","status":"published","published":"2026-09-18T15:55:46.914Z","modified":"2026-10-28T11:18:48.532018096Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T15:45:18.482949Z"},{"id":"DEBIAN-CVE-2026-84383","description":"libheif is a HEIF and AVIF file format decoder and encoder. From 1.22.0 until 1.23.2, a crafted HEIF, HEIC, or AVIF item graph using nested iden and auxl references can make HeifPixelImage::transfer_channel_from_image_as() append duplicate Alpha planes with different bit depths to m_storage. HeifPixelImage::scale_nearest_neighbor() in libheif/image/pixelimage.cc allocates the destination Alpha plane using the first plane's 8-bit depth, then iterates a later 10-bit or 12-bit Alpha component and writes uint16_t samples into the same 8-bit allocation. The output geometry controls the overflow extent and the encoded sample values control the data written, allowing a remote file processed by heif_decode_image() to cause a heap out-of-bounds write. This issue is fixed in version 1.23.2.","status":"published","published":"2026-09-18T16:17:11.707Z","modified":"2026-10-01T03:03:51.11457917Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:46:04.577397Z"},{"id":"openSUSE-SU-2026:11719-1","title":"gdk-pixbuf-loader-libheif-1.23.4-1.1 on GA media","description":"These are all security issues fixed in the gdk-pixbuf-loader-libheif-1.23.4-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-08T00:00:00Z","modified":"2026-09-09T10:00:04.830147944Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:21889-1","title":"Security update for libheif","description":"This update for libheif fixes the following issues:\n\n- CVE-2026-84383: Heap buffer overflow in scale_nearest_neighbor() via duplicate alpha planes from nested iden/auxl\n  items (bsc#1279443).\n- CVE-2026-84384: brotli/zlib decompression paths lack output-size limits, allowing decompression-bomb OOM/DoS\n  (bsc#1279445).\n- CVE-2026-84444: Out-of-bounds write in the unci encoder (bsc#1279448).\n- CVE-2026-84446: Sequence decode timing-table initialization allows non-terminating loops and unbounded memory,\n  bypassing max_sequence_frames (bsc#1279447).\n- CVE-2026-84447: Derived-image indirect reference chains and tiled offsets bypass decode caching and MemoryHandle\n  limits, causing CPU/memory amplification DoS (bsc#1279446).\n- CVE-2026-84448: Heap out-of-bounds read in the inline-mask region API (bsc#1279449).\n- CVE-2026-84450: image item with `clap` property and an ispe declaring a dimension greater than `INT32_MAX + 1` can\n  lead to a crash via an abort (bsc#1280002).\n- CVE-2026-84451: crafted HEIF file advertising a 4096 � 4096 uncompressed tile grid can cause an out-of-bounds read due\n  to an integer overflow (bsc#1280001).\n- Heap out-of-bounds write in the uncompressed encoder for RRGGBB images with interleaved bit-depth \u003c= 8 (bsc#1273083).\n- Out-of-bounds read and write in derived-item and pixel-plane handling (bsc#1279444).\n\nChanges for libheif:\n\n- Update to version 1.23.4:\n * CVE-2026-XXXXX: The max_items security limit was not enforced\n for the child boxes of iinf, so a file could declare an\n unbounded number of items.\n * CVE-2026-XXXXX: Unbounded recursion in the reference-cycle\n check crashed the parser on a long chain of derived items,\n without bound when the item-count limit is disabled.\n * CVE-2026-XXXXX: Permanent decoder deadlock through a lock-order\n inversion in parallel grid tile decoding (enabled by default).\n * CVE-2026-XXXXX: Heap out-of-bounds read in the encoder pluginsi\n for images whose luma and chroma bit depths differ.\n * CVE-2026-XXXXX: Unreclaimable memory leak in\n heif_track_get_next_raw_sequence_sample().\n * CVE-2026-XXXXX: Heap out-of-bounds read in the WebCodecs\n decoder plugin\n- includes fixes from 1.23.3:\n * CVE-2026-XXXXX: Heap buffer overflow (write) in the\n uncompressed (unci) mixed-interleave decoder when the two\n chroma components declare different bit depths.\n * CVE-2026-XXXXX: Permanent decoder deadlock through a reference\n cycle between an image and its alpha auxiliary image.\n * CVE-2026-XXXXX: Heap out-of-bounds read in the YCbCr 4:2:0 to\n 16-bit interleaved RGB conversion when the chroma planes have a\n lower bit depth than luma\n * CVE-2026-XXXXX: Heap buffer overflow in the SVT-AV1 encoder\n plugin when encoding a high-bit-depth alpha channel, and a\n double free on its send-picture error path.\n * CVE-2026-84451: Incomplete fix: the tile range check of the\n unci decoder (without icef) could still overflow, allowing an\n out-of-bounds read\n * CVE-2026-XXXXX: Heap out-of-bounds read when converting odd-\n height 4:2:0 frames of an uncompressed (uncv) image sequence to\n RGB.\n * CVE-2026-XXXXX: Out-of-bounds read in the RGB to YCbCr identity-\n matrix color conversion when the R, G, and B planes have\n different bit depths\n * CVE-2026-84450: A clap property combined with an oversized ispe\n reached an assert() in the Fraction arithmetic and aborted the\n process (incomplete fix). An error is returned instead.\n * Fix Several smaller findings\n * Fix Undefined behavior (negative shift) in the HDR bit-depth\n up-conversion for target bit depths above 16. Such conversions\n are now rejected.\n * A number of bug fixes\n- Update to version 1.23.2: [jsc#PED-16355]\n * CVE-2026-84383: Heap buffer overflow in\n scale_nearest_neighbor() via duplicate alpha planes from\n nested iden/auxl items. (boo#CVE-2026-84383)\n * Out-of-bounds read and write in derived-item and pixel-plane\n handling. Through iden and auxl item chains, a crafted file\n could attach pixel planes whose size differs from the image\n geometry; crop, scale, and plane-extraction code then indexed\n those planes with the wrong size. A working code-execution\n exploit was confirmed. Plane sizes are now validated wherever\n they are consumed. (boo#1279444)\n * CVE-2026-84384: brotli/zlib decompression of mime metadata\n and unci image data had no effective output-size limit, so a\n decompression bomb could exhaust memory. Decompressed output\n is now bounded by the security limits. (boo#1279445)\n * CVE-2026-84447: Chains of derived-image references (grid,\n iovl, iden) bypassed decode caching and memory limits, causing\n CPU and memory amplification. (boo#1279446)\n * CVE-2026-84446: Sequence sample-timing initialization could\n produce non-terminating decode loops and unbounded memory,\n bypassing max_sequence_frames. (boo#1279447)\n * CVE-2026-84444: Out-of-bounds write in the unci encoder when\n heif_context_add_image_tile() is given a tile whose planes do\n not match its declared size. (boo#1279448)\n * CVE-2026-84448: Heap out-of-bounds read in the inline-mask\n region API when mask_data_len does not match the region\n geometry. (boo#1279449)\n * C++ exceptions such as std::bad_alloc can no longer escape the\n C API read/decode entry points; they are returned as a\n heif_error instead of aborting the process\n * assert()s in the pixel-image plane allocation were replaced by\n runtime errors\n * stts/ctts tables describing more samples than the track can\n have are rejected\n * pclr (JPEG 2000 palette) box: the number of palette entries is\n bounded by the box size\n * BitReader::skip_bytes() is now constant time (fixes a fuzzer\n timeout on bogus alignment values)\n * iden items now validate the decoded image size like all other\n items\n * The uncompressed (unci) encoder rejects images without pixel\n planes\n * meta, mini, and moov boxes with size 0 (extending to the end of\n the file) are now parsed correctly\n * Fixed an integer overflow when probing the file size\n * Fixed undefined behavior (signed shift) when reading the NAL\n unit length in the OpenH264 decoder\n * heif_region_item_add_region_inline_mask_data() now requires\n non-zero width and height and the mask_data_len must equal\n the expected (width * height + 7) / 8; otherwise it returns\n an error instead of storing the mask\n * heif_image_add_plane() returns an error instead of aborting\n for bit depths outside 1..128 or interleaved component counts\n outside 1..255\n","status":"published","published":"2026-09-20T12:44:23Z","modified":"2026-09-25T18:23:11.529641806Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:4276-1","title":"Security update for libheif","description":"This update for libheif fixes the following issues:\n\n- CVE-2026-84383: Heap buffer overflow in scale_nearest_neighbor() via duplicate alpha planes from nested iden/auxl\n  items (bsc#1279443).\n- CVE-2026-84384: brotli/zlib decompression paths lack output-size limits, allowing decompression-bomb OOM/DoS\n  (bsc#1279445).\n- CVE-2026-84444: Out-of-bounds write in the unci encoder (bsc#1279448).\n- CVE-2026-84446: Sequence decode timing-table initialization allows non-terminating loops and unbounded memory,\n  bypassing max_sequence_frames (bsc#1279447).\n- CVE-2026-84447: Derived-image indirect reference chains and tiled offsets bypass decode caching and MemoryHandle\n  limits, causing CPU/memory amplification DoS (bsc#1279446).\n- CVE-2026-84448: Heap out-of-bounds read in the inline-mask region API (bsc#1279449).\n- CVE-2026-84450: image item with `clap` property and an ispe declaring a dimension greater than `INT32_MAX + 1` can\n  lead to a crash via an abort (bsc#1280002).\n- CVE-2026-84451: crafted HEIF file advertising a 4096 x 4096 uncompressed tile grid can cause an out-of-bounds read due\n  to an integer overflow (bsc#1280001).\n- Out-of-bounds read and write in derived-item and pixel-plane handling (bsc#1279444).\n\nChanges for libheif:\n\n- Update to version 1.23.4 (jsc#PED-16355)\n","status":"published","published":"2026-09-21T09:21:15Z","modified":"2026-09-22T10:30:21.899526482Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"UBUNTU-CVE-2026-84383","description":"[GHSA-g89c-p67h-r497: Heap buffer overflow in `scale_nearest_neighbor()` via duplicate Alpha planes from nested `iden`/`auxl` items]","status":"withdrawn","published":"2026-09-04T00:00:00Z","modified":"2026-09-16T02:45:03.516035916Z","updated_at":"2026-11-02T16:57:22.213888Z"}]}}