{"id":"CVE-2026-84444","aliases":["BELL-CVE-2026-84444","DEBIAN-CVE-2026-84444","EUVD-2026-83020","GHSA-j264-xvrp-5v7q","ROOT-OS-DEBIAN-12-CVE-2026-84444","ROOT-OS-DEBIAN-13-CVE-2026-84444","SUSE-SU-2026:4276-1","UBUNTU-CVE-2026-84444","openSUSE-SU-2026:11719-1","openSUSE-SU-2026:21889-1"],"status":"published","title":"libheif uncompressed tiled image encoding allows out-of-bounds write","description":"libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, when WITH_UNCOMPRESSED_CODEC is enabled, heif_context_add_image_tile() accepts an independently constructed tile whose component-plane dimensions do not match the tile geometry established by the prototype image. ImageItem_uncompressed::add_image_tile() passes that tile directly to unc_encoder::encode_tile(), which lacked the check_component_sizes() gate and sizes its output from the configured tile geometry while copying the tile's actual component-plane dimensions. An oversized component plane can therefore make unc_encoder_component_interleave::encode_tile() copy attacker-controlled data beyond the heap output buffer. This issue is fixed in version 1.23.2.","severity":{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00478,"percentile":0.41559,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2026-09-08T00:00:00Z","modified":"2026-11-03T13:15:02Z","fixes":[{"ecosystem":"Alpaquita:stream","package":"libheif","fixed_in":["1.23.4-r0"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libheif","fixed_in":["1.23.4-1~deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libheif","fixed_in":["1.23.2-1"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"libheif","fixed_in":["1.15.1-1+deb12u1.aikido.14","1.15.1-1+deb12u1.aikido.15","1.15.1-1+deb12u1.aikido.16","1.15.1-1+deb12u1.aikido.17"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-libheif","fixed_in":["1.15.1-1+deb12u1.aikido.14","1.15.1-1+deb12u1.aikido.15","1.15.1-1+deb12u1.aikido.16","1.15.1-1+deb12u1.aikido.17"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpaquita:stream","package":"libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.20.2-r2"},{"fixed":"1.23.4-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.15.1-1","1.15.1-1+deb12u1","1.16.2-1","1.16.2-2","1.16.2-3","1.17.0-1","1.17.1-1","1.17.4-1","1.17.6-1","1.17.6-2","1.17.6-3","1.17.6-4","1.18.1-1","1.18.1-2","1.18.2-1","1.18.2-2","1.19.1-1","1.19.1-1~bpo12+1","1.19.1-1~bpo12+2","1.19.3-1","1.19.3-1~bpo12+1","1.19.5-1","1.19.7-1","1.19.7-1~bpo12+1","1.19.8-1","1.20.1-1","1.20.2-1","1.20.2-2","1.21.2-1","1.21.2-2","1.21.2-3","1.21.2-4","1.23.1-1","1.23.2-1","1.23.3-1","1.23.4-1","1.23.4-1~deb13u1"]},{"source":"osv","ecosystem":"Debian:13","package":"libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.4-1~deb13u1"}]}],"versions":["1.19.8-1","1.19.8-1+deb13u1","1.20.1-1","1.20.2-1","1.20.2-2","1.21.2-1","1.21.2-2","1.21.2-3","1.21.2-4","1.23.1-1","1.23.2-1","1.23.3-1"]},{"source":"osv","ecosystem":"Debian:14","package":"libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.2-1"}]}],"versions":["1.19.8-1","1.20.1-1","1.20.2-1","1.20.2-2","1.21.2-1","1.21.2-2","1.21.2-3","1.21.2-4","1.23.1-1"]},{"source":"osv","ecosystem":"Root:Debian:12","package":"libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.1-1+deb12u1.aikido.14"},{"fixed":"1.15.1-1+deb12u1.aikido.15"},{"fixed":"1.15.1-1+deb12u1.aikido.16"},{"fixed":"1.15.1-1+deb12u1.aikido.17"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.1-1+deb12u1.aikido.14"},{"fixed":"1.15.1-1+deb12u1.aikido.15"},{"fixed":"1.15.1-1+deb12u1.aikido.16"},{"fixed":"1.15.1-1+deb12u1.aikido.17"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP7","package":"libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.4-150700.3.21.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.4-150700.3.21.1"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.4-1.1"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.4-160000.1.1"}]}],"bundled":8}],"products":[{"vendor":"strukturag","product":"libheif"}],"references":[{"url":"https://github.com/strukturag/libheif/security/advisories/GHSA-j264-xvrp-5v7q","tags":["x_refsource_CONFIRM","exploit","advisory","report"]},{"url":"https://github.com/strukturag/libheif/commit/e65071f59a1ac08aa1eb0d07a831deaf6bb4d03b","tags":["x_refsource_MISC","fix","report"]},{"url":"https://github.com/strukturag/libheif/releases/tag/v1.23.2","tags":["x_refsource_MISC","web","report"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-84444","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84444.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84444","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-84444","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264276-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1279443","tags":["report"]},{"url":"https://bugzilla.suse.com/1279444","tags":["report"]},{"url":"https://bugzilla.suse.com/1279445","tags":["report"]},{"url":"https://bugzilla.suse.com/1279446","tags":["report"]},{"url":"https://bugzilla.suse.com/1279447","tags":["report"]},{"url":"https://bugzilla.suse.com/1279448","tags":["report"]},{"url":"https://bugzilla.suse.com/1279449","tags":["report"]},{"url":"https://bugzilla.suse.com/1280001","tags":["report"]},{"url":"https://bugzilla.suse.com/1280002","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84383","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84384","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84444","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84446","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84447","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84448","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84450","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84451","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-84444","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84444","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1273083","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-84444","title":"libheif uncompressed tiled image encoding allows out-of-bounds write","description":"libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, when WITH_UNCOMPRESSED_CODEC is enabled, heif_context_add_image_tile() accepts an independently constructed tile whose component-plane dimensions do not match the tile geometry established by the prototype image. ImageItem_uncompressed::add_image_tile() passes that tile directly to unc_encoder::encode_tile(), which lacked the check_component_sizes() gate and sizes its output from the configured tile geometry while copying the tile's actual component-plane dimensions. An oversized component plane can therefore make unc_encoder_component_interleave::encode_tile() copy attacker-controlled data beyond the heap output buffer. This issue is fixed in version 1.23.2.","status":"published","published":"2026-09-18T15:56:41.773Z","modified":"2026-09-22T14:50:28.718Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:20:08.391556Z"}],"euvd":[{"id":"EUVD-2026-83020","description":"libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, when WITH_UNCOMPRESSED_CODEC is enabled, heif_context_add_image_tile() accepts an independently constructed tile whose component-plane dimensions do not match the tile geometry established by the prototype image. ImageItem_uncompressed::add_image_tile() passes that tile directly to unc_encoder::encode_tile(), which lacked the check_component_sizes() gate and sizes its output from the configured tile geometry while copying the tile's actual component-plane dimensions. An oversized component plane can therefore make unc_encoder_component_interleave::encode_tile() copy attacker-controlled data beyond the heap output buffer. This issue is fixed in version 1.23.2.","status":"published","published":"2026-09-18T15:56:41Z","modified":"2026-09-22T14:50:28Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T17:28:02.937716Z"}],"nvd":[{"id":"CVE-2026-84444","description":"libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, when WITH_UNCOMPRESSED_CODEC is enabled, heif_context_add_image_tile() accepts an independently constructed tile whose component-plane dimensions do not match the tile geometry established by the prototype image. ImageItem_uncompressed::add_image_tile() passes that tile directly to unc_encoder::encode_tile(), which lacked the check_component_sizes() gate and sizes its output from the configured tile geometry while copying the tile's actual component-plane dimensions. An oversized component plane can therefore make unc_encoder_component_interleave::encode_tile() copy attacker-controlled data beyond the heap output buffer. This issue is fixed in version 1.23.2.","status":"published","published":"2026-09-18T16:17:12.357Z","modified":"2026-09-22T15:17:19.093Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:12:49.70655Z"}],"osv":[{"id":"BELL-CVE-2026-84444","status":"published","published":"2026-09-23T06:08:04.735954Z","modified":"2026-10-02T07:15:05.161570397Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:26.341144Z"},{"id":"CVE-2026-84444","title":"libheif uncompressed tiled image encoding allows out-of-bounds write","description":"libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, when WITH_UNCOMPRESSED_CODEC is enabled, heif_context_add_image_tile() accepts an independently constructed tile whose component-plane dimensions do not match the tile geometry established by the prototype image. ImageItem_uncompressed::add_image_tile() passes that tile directly to unc_encoder::encode_tile(), which lacked the check_component_sizes() gate and sizes its output from the configured tile geometry while copying the tile's actual component-plane dimensions. An oversized component plane can therefore make unc_encoder_component_interleave::encode_tile() copy attacker-controlled data beyond the heap output buffer. This issue is fixed in version 1.23.2.","status":"published","published":"2026-09-18T15:56:41.773Z","modified":"2026-10-28T11:18:47.309718225Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"high"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T15:45:18.482949Z"},{"id":"DEBIAN-CVE-2026-84444","description":"libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, when WITH_UNCOMPRESSED_CODEC is enabled, heif_context_add_image_tile() accepts an independently constructed tile whose component-plane dimensions do not match the tile geometry established by the prototype image. ImageItem_uncompressed::add_image_tile() passes that tile directly to unc_encoder::encode_tile(), which lacked the check_component_sizes() gate and sizes its output from the configured tile geometry while copying the tile's actual component-plane dimensions. An oversized component plane can therefore make unc_encoder_component_interleave::encode_tile() copy attacker-controlled data beyond the heap output buffer. This issue is fixed in version 1.23.2.","status":"published","published":"2026-09-18T16:17:12.357Z","modified":"2026-09-28T10:00:07.212583896Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:46:04.577397Z"},{"id":"UBUNTU-CVE-2026-84444","description":"libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, when WITH_UNCOMPRESSED_CODEC is enabled, heif_context_add_image_tile() accepts an independently constructed tile whose component-plane dimensions do not match the tile geometry established by the prototype image. ImageItem_uncompressed::add_image_tile() passes that tile directly to unc_encoder::encode_tile(), which lacked the check_component_sizes() gate and sizes its output from the configured tile geometry while copying the tile's actual component-plane dimensions. An oversized component plane can therefore make unc_encoder_component_interleave::encode_tile() copy attacker-controlled data beyond the heap output buffer. This issue is fixed in version 1.23.2.","status":"withdrawn","published":"2026-09-18T16:17:00Z","modified":"2026-09-25T00:39:33.650864849Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:57:22.213888Z"},{"id":"openSUSE-SU-2026:11719-1","title":"gdk-pixbuf-loader-libheif-1.23.4-1.1 on GA media","description":"These are all security issues fixed in the gdk-pixbuf-loader-libheif-1.23.4-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-08T00:00:00Z","modified":"2026-09-09T10:00:04.830147944Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:21889-1","title":"Security update for libheif","description":"This update for libheif fixes the following issues:\n\n- CVE-2026-84383: Heap buffer overflow in scale_nearest_neighbor() via duplicate alpha planes from nested iden/auxl\n  items (bsc#1279443).\n- CVE-2026-84384: brotli/zlib decompression paths lack output-size limits, allowing decompression-bomb OOM/DoS\n  (bsc#1279445).\n- CVE-2026-84444: Out-of-bounds write in the unci encoder (bsc#1279448).\n- CVE-2026-84446: Sequence decode timing-table initialization allows non-terminating loops and unbounded memory,\n  bypassing max_sequence_frames (bsc#1279447).\n- CVE-2026-84447: Derived-image indirect reference chains and tiled offsets bypass decode caching and MemoryHandle\n  limits, causing CPU/memory amplification DoS (bsc#1279446).\n- CVE-2026-84448: Heap out-of-bounds read in the inline-mask region API (bsc#1279449).\n- CVE-2026-84450: image item with `clap` property and an ispe declaring a dimension greater than `INT32_MAX + 1` can\n  lead to a crash via an abort (bsc#1280002).\n- CVE-2026-84451: crafted HEIF file advertising a 4096 � 4096 uncompressed tile grid can cause an out-of-bounds read due\n  to an integer overflow (bsc#1280001).\n- Heap out-of-bounds write in the uncompressed encoder for RRGGBB images with interleaved bit-depth \u003c= 8 (bsc#1273083).\n- Out-of-bounds read and write in derived-item and pixel-plane handling (bsc#1279444).\n\nChanges for libheif:\n\n- Update to version 1.23.4:\n * CVE-2026-XXXXX: The max_items security limit was not enforced\n for the child boxes of iinf, so a file could declare an\n unbounded number of items.\n * CVE-2026-XXXXX: Unbounded recursion in the reference-cycle\n check crashed the parser on a long chain of derived items,\n without bound when the item-count limit is disabled.\n * CVE-2026-XXXXX: Permanent decoder deadlock through a lock-order\n inversion in parallel grid tile decoding (enabled by default).\n * CVE-2026-XXXXX: Heap out-of-bounds read in the encoder pluginsi\n for images whose luma and chroma bit depths differ.\n * CVE-2026-XXXXX: Unreclaimable memory leak in\n heif_track_get_next_raw_sequence_sample().\n * CVE-2026-XXXXX: Heap out-of-bounds read in the WebCodecs\n decoder plugin\n- includes fixes from 1.23.3:\n * CVE-2026-XXXXX: Heap buffer overflow (write) in the\n uncompressed (unci) mixed-interleave decoder when the two\n chroma components declare different bit depths.\n * CVE-2026-XXXXX: Permanent decoder deadlock through a reference\n cycle between an image and its alpha auxiliary image.\n * CVE-2026-XXXXX: Heap out-of-bounds read in the YCbCr 4:2:0 to\n 16-bit interleaved RGB conversion when the chroma planes have a\n lower bit depth than luma\n * CVE-2026-XXXXX: Heap buffer overflow in the SVT-AV1 encoder\n plugin when encoding a high-bit-depth alpha channel, and a\n double free on its send-picture error path.\n * CVE-2026-84451: Incomplete fix: the tile range check of the\n unci decoder (without icef) could still overflow, allowing an\n out-of-bounds read\n * CVE-2026-XXXXX: Heap out-of-bounds read when converting odd-\n height 4:2:0 frames of an uncompressed (uncv) image sequence to\n RGB.\n * CVE-2026-XXXXX: Out-of-bounds read in the RGB to YCbCr identity-\n matrix color conversion when the R, G, and B planes have\n different bit depths\n * CVE-2026-84450: A clap property combined with an oversized ispe\n reached an assert() in the Fraction arithmetic and aborted the\n process (incomplete fix). An error is returned instead.\n * Fix Several smaller findings\n * Fix Undefined behavior (negative shift) in the HDR bit-depth\n up-conversion for target bit depths above 16. Such conversions\n are now rejected.\n * A number of bug fixes\n- Update to version 1.23.2: [jsc#PED-16355]\n * CVE-2026-84383: Heap buffer overflow in\n scale_nearest_neighbor() via duplicate alpha planes from\n nested iden/auxl items. (boo#CVE-2026-84383)\n * Out-of-bounds read and write in derived-item and pixel-plane\n handling. Through iden and auxl item chains, a crafted file\n could attach pixel planes whose size differs from the image\n geometry; crop, scale, and plane-extraction code then indexed\n those planes with the wrong size. A working code-execution\n exploit was confirmed. Plane sizes are now validated wherever\n they are consumed. (boo#1279444)\n * CVE-2026-84384: brotli/zlib decompression of mime metadata\n and unci image data had no effective output-size limit, so a\n decompression bomb could exhaust memory. Decompressed output\n is now bounded by the security limits. (boo#1279445)\n * CVE-2026-84447: Chains of derived-image references (grid,\n iovl, iden) bypassed decode caching and memory limits, causing\n CPU and memory amplification. (boo#1279446)\n * CVE-2026-84446: Sequence sample-timing initialization could\n produce non-terminating decode loops and unbounded memory,\n bypassing max_sequence_frames. (boo#1279447)\n * CVE-2026-84444: Out-of-bounds write in the unci encoder when\n heif_context_add_image_tile() is given a tile whose planes do\n not match its declared size. (boo#1279448)\n * CVE-2026-84448: Heap out-of-bounds read in the inline-mask\n region API when mask_data_len does not match the region\n geometry. (boo#1279449)\n * C++ exceptions such as std::bad_alloc can no longer escape the\n C API read/decode entry points; they are returned as a\n heif_error instead of aborting the process\n * assert()s in the pixel-image plane allocation were replaced by\n runtime errors\n * stts/ctts tables describing more samples than the track can\n have are rejected\n * pclr (JPEG 2000 palette) box: the number of palette entries is\n bounded by the box size\n * BitReader::skip_bytes() is now constant time (fixes a fuzzer\n timeout on bogus alignment values)\n * iden items now validate the decoded image size like all other\n items\n * The uncompressed (unci) encoder rejects images without pixel\n planes\n * meta, mini, and moov boxes with size 0 (extending to the end of\n the file) are now parsed correctly\n * Fixed an integer overflow when probing the file size\n * Fixed undefined behavior (signed shift) when reading the NAL\n unit length in the OpenH264 decoder\n * heif_region_item_add_region_inline_mask_data() now requires\n non-zero width and height and the mask_data_len must equal\n the expected (width * height + 7) / 8; otherwise it returns\n an error instead of storing the mask\n * heif_image_add_plane() returns an error instead of aborting\n for bit depths outside 1..128 or interleaved component counts\n outside 1..255\n","status":"published","published":"2026-09-20T12:44:23Z","modified":"2026-09-25T18:23:11.529641806Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2026-84444","title":"CVE-2026-84444 in libheif - Patched by Root","description":"Root has patched CVE-2026-84444 in the libheif package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-11-03T12:12:10Z","modified":"2026-11-03T13:15:02.826273265Z","updated_at":"2026-11-03T13:33:04.521148Z"},{"id":"ROOT-OS-DEBIAN-13-CVE-2026-84444","title":"CVE-2026-84444 in libheif - Patched by Root","description":"Root has patched CVE-2026-84444 in the libheif package for Root:Debian:13. Multiple fixed versions available.","status":"withdrawn","published":"2026-09-25T11:22:46Z","modified":"2026-10-06T13:00:05.293010691Z","updated_at":"2026-11-02T15:53:33.681527Z"},{"id":"SUSE-SU-2026:4276-1","title":"Security update for libheif","description":"This update for libheif fixes the following issues:\n\n- CVE-2026-84383: Heap buffer overflow in scale_nearest_neighbor() via duplicate alpha planes from nested iden/auxl\n  items (bsc#1279443).\n- CVE-2026-84384: brotli/zlib decompression paths lack output-size limits, allowing decompression-bomb OOM/DoS\n  (bsc#1279445).\n- CVE-2026-84444: Out-of-bounds write in the unci encoder (bsc#1279448).\n- CVE-2026-84446: Sequence decode timing-table initialization allows non-terminating loops and unbounded memory,\n  bypassing max_sequence_frames (bsc#1279447).\n- CVE-2026-84447: Derived-image indirect reference chains and tiled offsets bypass decode caching and MemoryHandle\n  limits, causing CPU/memory amplification DoS (bsc#1279446).\n- CVE-2026-84448: Heap out-of-bounds read in the inline-mask region API (bsc#1279449).\n- CVE-2026-84450: image item with `clap` property and an ispe declaring a dimension greater than `INT32_MAX + 1` can\n  lead to a crash via an abort (bsc#1280002).\n- CVE-2026-84451: crafted HEIF file advertising a 4096 x 4096 uncompressed tile grid can cause an out-of-bounds read due\n  to an integer overflow (bsc#1280001).\n- Out-of-bounds read and write in derived-item and pixel-plane handling (bsc#1279444).\n\nChanges for libheif:\n\n- Update to version 1.23.4 (jsc#PED-16355)\n","status":"published","published":"2026-09-21T09:21:15Z","modified":"2026-09-22T10:30:21.899526482Z","updated_at":"2026-11-02T15:54:05.838224Z"}]}}