CVE-2026-84451: CWE-125: Out-of-bounds Read in strukturag libheif
CVE-2026-84451 is an out-of-bounds read vulnerability in the strukturag libheif library versions from 1.19.0 up to but not including 1.23.3. It occurs in the no-icef full-item branch of the function unc_decoder::get_compressed_image_data_uncompressed(), where an addition-based range check can wrap due to crafted uncompressed tile grid parameters. This allows memcpy() to be called with an invalid source pointer and a large length when decoding a high-index tile, potentially causing application crashes. The issue is a partial remediation of a previous vulnerability (CVE-2026-62292) and does not affect whole-image decoding. The vulnerability has a medium severity with a CVSS score of 6.5 and was fixed in version 1.23.3.
AI Analysis
Technical Summary
The vulnerability in libheif (CVE-2026-84451) involves an out-of-bounds read caused by an integer wrap in a range check within the no-icef full-item branch of unc_decoder::get_compressed_image_data_uncompressed(). Specifically, when a crafted uncompressed tile grid produces large range_start_offset and range_size values, the addition-based range check can wrap, causing the bounds comparison to incorrectly pass. This leads to heif_image_handle_decode_image_tile() invoking memcpy() with an invalid source pointer and an excessively large length for a high-index tile. This flaw can reliably crash applications processing tiles but does not affect whole-image decoding paths. The vulnerability is an incomplete fix of CVE-2026-62292 and was resolved in libheif version 1.23.3.
Potential Impact
Exploitation of this vulnerability can cause denial of service by crashing applications that process HEIF/AVIF image tiles using vulnerable libheif versions. There is no indication of confidentiality or integrity impact. The vulnerability does not affect whole-image decoding, limiting the scope of impact to tile-processing scenarios.
Mitigation Recommendations
This vulnerability is fixed in libheif version 1.23.3. Users and vendors should upgrade to version 1.23.3 or later to remediate this issue. No other mitigation or workaround is indicated by the vendor advisory.
CVE-2026-84451: CWE-125: Out-of-bounds Read in strukturag libheif
Description
CVE-2026-84451 is an out-of-bounds read vulnerability in the strukturag libheif library versions from 1.19.0 up to but not including 1.23.3. It occurs in the no-icef full-item branch of the function unc_decoder::get_compressed_image_data_uncompressed(), where an addition-based range check can wrap due to crafted uncompressed tile grid parameters. This allows memcpy() to be called with an invalid source pointer and a large length when decoding a high-index tile, potentially causing application crashes. The issue is a partial remediation of a previous vulnerability (CVE-2026-62292) and does not affect whole-image decoding. The vulnerability has a medium severity with a CVSS score of 6.5 and was fixed in version 1.23.3.
CVSS v3.1
Score 6.5medium
Affected software
strukturag
libheif
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in libheif (CVE-2026-84451) involves an out-of-bounds read caused by an integer wrap in a range check within the no-icef full-item branch of unc_decoder::get_compressed_image_data_uncompressed(). Specifically, when a crafted uncompressed tile grid produces large range_start_offset and range_size values, the addition-based range check can wrap, causing the bounds comparison to incorrectly pass. This leads to heif_image_handle_decode_image_tile() invoking memcpy() with an invalid source pointer and an excessively large length for a high-index tile. This flaw can reliably crash applications processing tiles but does not affect whole-image decoding paths. The vulnerability is an incomplete fix of CVE-2026-62292 and was resolved in libheif version 1.23.3.
Potential Impact
Exploitation of this vulnerability can cause denial of service by crashing applications that process HEIF/AVIF image tiles using vulnerable libheif versions. There is no indication of confidentiality or integrity impact. The vulnerability does not affect whole-image decoding, limiting the scope of impact to tile-processing scenarios.
Mitigation Recommendations
This vulnerability is fixed in libheif version 1.23.3. Users and vendors should upgrade to version 1.23.3 or later to remediate this issue. No other mitigation or workaround is indicated by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-09-01T20:05:09.423Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aad640a55bf5e2cf53a6a58
Added to database: 09/18/2026, 16:17:14 UTC
Last enriched: 09/18/2026, 16:32:02 UTC
Last updated: 09/18/2026, 17:20:24 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.