{"id":"CVE-2026-84450","aliases":["BELL-CVE-2026-84450","DEBIAN-CVE-2026-84450","EUVD-2026-83028","GHSA-gh5q-69gg-c964","SUSE-SU-2026:4276-1","UBUNTU-CVE-2026-84450","openSUSE-SU-2026:11719-1","openSUSE-SU-2026:21889-1"],"status":"published","title":"libheif: `clap` + oversized `ispe` aborts on an assert in `Fraction::Fraction` (incomplete fix for CVE-2026-62289)","description":"libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.3, a crafted image item containing a clap property and an ispe width or height greater than INT32_MAX + 1 can reach crop calculations through heif_image_handle_get_image_tiling(). Box_clap::left_rounded() or Box_clap::top_rounded() passes the image dimension minus one to Fraction::Fraction(), whose uint32_t constructor uses an assertion as input validation, causing assert-enabled builds to abort. Release builds can instead compute invalid crop geometry, and the tiling API returns dimensions that the normal decode security limits reject. This issue is fixed in version 1.23.3.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00284,"percentile":0.21185,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-617"],"published":"2026-09-04T00:00:00Z","modified":"2026-10-28T11:18:48Z","fixes":[{"ecosystem":"Alpaquita:stream","package":"libheif","fixed_in":["1.23.4-r0"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libheif","fixed_in":["1.23.4-1~deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libheif","fixed_in":["1.23.3-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpaquita:stream","package":"libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.20.2-r2"},{"fixed":"1.23.4-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.15.1-1","1.15.1-1+deb12u1","1.16.2-1","1.16.2-2","1.16.2-3","1.17.0-1","1.17.1-1","1.17.4-1","1.17.6-1","1.17.6-2","1.17.6-3","1.17.6-4","1.18.1-1","1.18.1-2","1.18.2-1","1.18.2-2","1.19.1-1","1.19.1-1~bpo12+1","1.19.1-1~bpo12+2","1.19.3-1","1.19.3-1~bpo12+1","1.19.5-1","1.19.7-1","1.19.7-1~bpo12+1","1.19.8-1","1.20.1-1","1.20.2-1","1.20.2-2","1.21.2-1","1.21.2-2","1.21.2-3","1.21.2-4","1.23.1-1","1.23.2-1","1.23.3-1","1.23.4-1","1.23.4-1~deb13u1"]},{"source":"osv","ecosystem":"Debian:13","package":"libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.4-1~deb13u1"}]}],"versions":["1.19.8-1","1.19.8-1+deb13u1","1.20.1-1","1.20.2-1","1.20.2-2","1.21.2-1","1.21.2-2","1.21.2-3","1.21.2-4","1.23.1-1","1.23.2-1","1.23.3-1"]},{"source":"osv","ecosystem":"Debian:14","package":"libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.3-1"}]}],"versions":["1.19.8-1","1.20.1-1","1.20.2-1","1.20.2-2","1.21.2-1","1.21.2-2","1.21.2-3","1.21.2-4","1.23.1-1","1.23.2-1"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP7","package":"libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.4-150700.3.21.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.4-150700.3.21.1"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.4-1.1"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.4-160000.1.1"}]}],"bundled":8}],"products":[{"vendor":"strukturag","product":"libheif"}],"references":[{"url":"https://github.com/strukturag/libheif/security/advisories/GHSA-gh5q-69gg-c964","tags":["x_refsource_CONFIRM","advisory"]},{"url":"https://github.com/strukturag/libheif/commit/1c2df9c0e814f89716f3a4d85a444b2dbc63ad69","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/strukturag/libheif/releases/tag/v1.23.3","tags":["x_refsource_MISC","web"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-84450","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84450.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84450","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-84450","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264276-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1279443","tags":["report"]},{"url":"https://bugzilla.suse.com/1279444","tags":["report"]},{"url":"https://bugzilla.suse.com/1279445","tags":["report"]},{"url":"https://bugzilla.suse.com/1279446","tags":["report"]},{"url":"https://bugzilla.suse.com/1279447","tags":["report"]},{"url":"https://bugzilla.suse.com/1279448","tags":["report"]},{"url":"https://bugzilla.suse.com/1279449","tags":["report"]},{"url":"https://bugzilla.suse.com/1280001","tags":["report"]},{"url":"https://bugzilla.suse.com/1280002","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84383","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84384","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84444","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84446","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84447","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84448","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84450","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84451","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-84450","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84450","tags":["report"]},{"url":"https://github.com/strukturag/libheif/security/advisories/GHSA-hh47-fhqr-cj2r","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1273083","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-84450","title":"libheif: `clap` + oversized `ispe` aborts on an assert in `Fraction::Fraction` (incomplete fix for CVE-2026-62289)","description":"libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.3, a crafted image item containing a clap property and an ispe width or height greater than INT32_MAX + 1 can reach crop calculations through heif_image_handle_get_image_tiling(). Box_clap::left_rounded() or Box_clap::top_rounded() passes the image dimension minus one to Fraction::Fraction(), whose uint32_t constructor uses an assertion as input validation, causing assert-enabled builds to abort. Release builds can instead compute invalid crop geometry, and the tiling API returns dimensions that the normal decode security limits reject. This issue is fixed in version 1.23.3.","status":"published","published":"2026-09-18T16:04:54.422Z","modified":"2026-09-21T20:50:24.867Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-617"],"updated_at":"2026-11-02T14:20:08.391556Z"}],"euvd":[{"id":"EUVD-2026-83028","description":"libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.3, a crafted image item containing a clap property and an ispe width or height greater than INT32_MAX + 1 can reach crop calculations through heif_image_handle_get_image_tiling(). Box_clap::left_rounded() or Box_clap::top_rounded() passes the image dimension minus one to Fraction::Fraction(), whose uint32_t constructor uses an assertion as input validation, causing assert-enabled builds to abort. Release builds can instead compute invalid crop geometry, and the tiling API returns dimensions that the normal decode security limits reject. This issue is fixed in version 1.23.3.","status":"published","published":"2026-09-18T16:04:54Z","modified":"2026-09-21T20:50:24Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T17:28:04.224689Z"}],"nvd":[{"id":"CVE-2026-84450","description":"libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.3, a crafted image item containing a clap property and an ispe width or height greater than INT32_MAX + 1 can reach crop calculations through heif_image_handle_get_image_tiling(). Box_clap::left_rounded() or Box_clap::top_rounded() passes the image dimension minus one to Fraction::Fraction(), whose uint32_t constructor uses an assertion as input validation, causing assert-enabled builds to abort. Release builds can instead compute invalid crop geometry, and the tiling API returns dimensions that the normal decode security limits reject. This issue is fixed in version 1.23.3.","status":"published","published":"2026-09-18T16:17:13.16Z","modified":"2026-09-21T21:17:13.8Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-617"],"updated_at":"2026-11-02T14:12:49.70655Z"}],"osv":[{"id":"BELL-CVE-2026-84450","status":"published","published":"2026-09-08T06:05:20.939015Z","modified":"2026-10-02T07:15:05.504531328Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:28:26.341144Z"},{"id":"CVE-2026-84450","title":"libheif: `clap` + oversized `ispe` aborts on an assert in `Fraction::Fraction` (incomplete fix for CVE-2026-62289)","description":"libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.3, a crafted image item containing a clap property and an ispe width or height greater than INT32_MAX + 1 can reach crop calculations through heif_image_handle_get_image_tiling(). Box_clap::left_rounded() or Box_clap::top_rounded() passes the image dimension minus one to Fraction::Fraction(), whose uint32_t constructor uses an assertion as input validation, causing assert-enabled builds to abort. Release builds can instead compute invalid crop geometry, and the tiling API returns dimensions that the normal decode security limits reject. This issue is fixed in version 1.23.3.","status":"published","published":"2026-09-18T16:04:54.422Z","modified":"2026-10-28T11:18:48.136107241Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-617"],"updated_at":"2026-11-02T15:45:18.482949Z"},{"id":"DEBIAN-CVE-2026-84450","description":"libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.3, a crafted image item containing a clap property and an ispe width or height greater than INT32_MAX + 1 can reach crop calculations through heif_image_handle_get_image_tiling(). Box_clap::left_rounded() or Box_clap::top_rounded() passes the image dimension minus one to Fraction::Fraction(), whose uint32_t constructor uses an assertion as input validation, causing assert-enabled builds to abort. Release builds can instead compute invalid crop geometry, and the tiling API returns dimensions that the normal decode security limits reject. This issue is fixed in version 1.23.3.","status":"published","published":"2026-09-18T16:17:13.16Z","modified":"2026-10-01T03:03:51.268652124Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:46:04.577397Z"},{"id":"openSUSE-SU-2026:11719-1","title":"gdk-pixbuf-loader-libheif-1.23.4-1.1 on GA media","description":"These are all security issues fixed in the gdk-pixbuf-loader-libheif-1.23.4-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-08T00:00:00Z","modified":"2026-09-09T10:00:04.830147944Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:21889-1","title":"Security update for libheif","description":"This update for libheif fixes the following issues:\n\n- CVE-2026-84383: Heap buffer overflow in scale_nearest_neighbor() via duplicate alpha planes from nested iden/auxl\n  items (bsc#1279443).\n- CVE-2026-84384: brotli/zlib decompression paths lack output-size limits, allowing decompression-bomb OOM/DoS\n  (bsc#1279445).\n- CVE-2026-84444: Out-of-bounds write in the unci encoder (bsc#1279448).\n- CVE-2026-84446: Sequence decode timing-table initialization allows non-terminating loops and unbounded memory,\n  bypassing max_sequence_frames (bsc#1279447).\n- CVE-2026-84447: Derived-image indirect reference chains and tiled offsets bypass decode caching and MemoryHandle\n  limits, causing CPU/memory amplification DoS (bsc#1279446).\n- CVE-2026-84448: Heap out-of-bounds read in the inline-mask region API (bsc#1279449).\n- CVE-2026-84450: image item with `clap` property and an ispe declaring a dimension greater than `INT32_MAX + 1` can\n  lead to a crash via an abort (bsc#1280002).\n- CVE-2026-84451: crafted HEIF file advertising a 4096 � 4096 uncompressed tile grid can cause an out-of-bounds read due\n  to an integer overflow (bsc#1280001).\n- Heap out-of-bounds write in the uncompressed encoder for RRGGBB images with interleaved bit-depth \u003c= 8 (bsc#1273083).\n- Out-of-bounds read and write in derived-item and pixel-plane handling (bsc#1279444).\n\nChanges for libheif:\n\n- Update to version 1.23.4:\n * CVE-2026-XXXXX: The max_items security limit was not enforced\n for the child boxes of iinf, so a file could declare an\n unbounded number of items.\n * CVE-2026-XXXXX: Unbounded recursion in the reference-cycle\n check crashed the parser on a long chain of derived items,\n without bound when the item-count limit is disabled.\n * CVE-2026-XXXXX: Permanent decoder deadlock through a lock-order\n inversion in parallel grid tile decoding (enabled by default).\n * CVE-2026-XXXXX: Heap out-of-bounds read in the encoder pluginsi\n for images whose luma and chroma bit depths differ.\n * CVE-2026-XXXXX: Unreclaimable memory leak in\n heif_track_get_next_raw_sequence_sample().\n * CVE-2026-XXXXX: Heap out-of-bounds read in the WebCodecs\n decoder plugin\n- includes fixes from 1.23.3:\n * CVE-2026-XXXXX: Heap buffer overflow (write) in the\n uncompressed (unci) mixed-interleave decoder when the two\n chroma components declare different bit depths.\n * CVE-2026-XXXXX: Permanent decoder deadlock through a reference\n cycle between an image and its alpha auxiliary image.\n * CVE-2026-XXXXX: Heap out-of-bounds read in the YCbCr 4:2:0 to\n 16-bit interleaved RGB conversion when the chroma planes have a\n lower bit depth than luma\n * CVE-2026-XXXXX: Heap buffer overflow in the SVT-AV1 encoder\n plugin when encoding a high-bit-depth alpha channel, and a\n double free on its send-picture error path.\n * CVE-2026-84451: Incomplete fix: the tile range check of the\n unci decoder (without icef) could still overflow, allowing an\n out-of-bounds read\n * CVE-2026-XXXXX: Heap out-of-bounds read when converting odd-\n height 4:2:0 frames of an uncompressed (uncv) image sequence to\n RGB.\n * CVE-2026-XXXXX: Out-of-bounds read in the RGB to YCbCr identity-\n matrix color conversion when the R, G, and B planes have\n different bit depths\n * CVE-2026-84450: A clap property combined with an oversized ispe\n reached an assert() in the Fraction arithmetic and aborted the\n process (incomplete fix). An error is returned instead.\n * Fix Several smaller findings\n * Fix Undefined behavior (negative shift) in the HDR bit-depth\n up-conversion for target bit depths above 16. Such conversions\n are now rejected.\n * A number of bug fixes\n- Update to version 1.23.2: [jsc#PED-16355]\n * CVE-2026-84383: Heap buffer overflow in\n scale_nearest_neighbor() via duplicate alpha planes from\n nested iden/auxl items. (boo#CVE-2026-84383)\n * Out-of-bounds read and write in derived-item and pixel-plane\n handling. Through iden and auxl item chains, a crafted file\n could attach pixel planes whose size differs from the image\n geometry; crop, scale, and plane-extraction code then indexed\n those planes with the wrong size. A working code-execution\n exploit was confirmed. Plane sizes are now validated wherever\n they are consumed. (boo#1279444)\n * CVE-2026-84384: brotli/zlib decompression of mime metadata\n and unci image data had no effective output-size limit, so a\n decompression bomb could exhaust memory. Decompressed output\n is now bounded by the security limits. (boo#1279445)\n * CVE-2026-84447: Chains of derived-image references (grid,\n iovl, iden) bypassed decode caching and memory limits, causing\n CPU and memory amplification. (boo#1279446)\n * CVE-2026-84446: Sequence sample-timing initialization could\n produce non-terminating decode loops and unbounded memory,\n bypassing max_sequence_frames. (boo#1279447)\n * CVE-2026-84444: Out-of-bounds write in the unci encoder when\n heif_context_add_image_tile() is given a tile whose planes do\n not match its declared size. (boo#1279448)\n * CVE-2026-84448: Heap out-of-bounds read in the inline-mask\n region API when mask_data_len does not match the region\n geometry. (boo#1279449)\n * C++ exceptions such as std::bad_alloc can no longer escape the\n C API read/decode entry points; they are returned as a\n heif_error instead of aborting the process\n * assert()s in the pixel-image plane allocation were replaced by\n runtime errors\n * stts/ctts tables describing more samples than the track can\n have are rejected\n * pclr (JPEG 2000 palette) box: the number of palette entries is\n bounded by the box size\n * BitReader::skip_bytes() is now constant time (fixes a fuzzer\n timeout on bogus alignment values)\n * iden items now validate the decoded image size like all other\n items\n * The uncompressed (unci) encoder rejects images without pixel\n planes\n * meta, mini, and moov boxes with size 0 (extending to the end of\n the file) are now parsed correctly\n * Fixed an integer overflow when probing the file size\n * Fixed undefined behavior (signed shift) when reading the NAL\n unit length in the OpenH264 decoder\n * heif_region_item_add_region_inline_mask_data() now requires\n non-zero width and height and the mask_data_len must equal\n the expected (width * height + 7) / 8; otherwise it returns\n an error instead of storing the mask\n * heif_image_add_plane() returns an error instead of aborting\n for bit depths outside 1..128 or interleaved component counts\n outside 1..255\n","status":"published","published":"2026-09-20T12:44:23Z","modified":"2026-09-25T18:23:11.529641806Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:4276-1","title":"Security update for libheif","description":"This update for libheif fixes the following issues:\n\n- CVE-2026-84383: Heap buffer overflow in scale_nearest_neighbor() via duplicate alpha planes from nested iden/auxl\n  items (bsc#1279443).\n- CVE-2026-84384: brotli/zlib decompression paths lack output-size limits, allowing decompression-bomb OOM/DoS\n  (bsc#1279445).\n- CVE-2026-84444: Out-of-bounds write in the unci encoder (bsc#1279448).\n- CVE-2026-84446: Sequence decode timing-table initialization allows non-terminating loops and unbounded memory,\n  bypassing max_sequence_frames (bsc#1279447).\n- CVE-2026-84447: Derived-image indirect reference chains and tiled offsets bypass decode caching and MemoryHandle\n  limits, causing CPU/memory amplification DoS (bsc#1279446).\n- CVE-2026-84448: Heap out-of-bounds read in the inline-mask region API (bsc#1279449).\n- CVE-2026-84450: image item with `clap` property and an ispe declaring a dimension greater than `INT32_MAX + 1` can\n  lead to a crash via an abort (bsc#1280002).\n- CVE-2026-84451: crafted HEIF file advertising a 4096 x 4096 uncompressed tile grid can cause an out-of-bounds read due\n  to an integer overflow (bsc#1280001).\n- Out-of-bounds read and write in derived-item and pixel-plane handling (bsc#1279444).\n\nChanges for libheif:\n\n- Update to version 1.23.4 (jsc#PED-16355)\n","status":"published","published":"2026-09-21T09:21:15Z","modified":"2026-09-22T10:30:21.899526482Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"UBUNTU-CVE-2026-84450","description":"[Incomplete fix for GHSA-73p7-m7gg-w2jv leaves libheif 1.23.1 vulnerable to an out-of-bounds read]","status":"withdrawn","published":"2026-09-04T00:00:00Z","modified":"2026-09-16T02:45:03.528725901Z","updated_at":"2026-11-02T16:57:22.213888Z"}]}}