CVE-2026-84444: strukturag libheif Out-of-bounds Write

Vulnerability summary

CVE-2026-84444 is a high (CVSS 7.4) Out-of-bounds Write vulnerability in strukturag libheif. EPSS estimates a 0.48% chance of exploitation in the next 30 days, higher than 39.9% of scored vulnerabilities.

Timeline

1. 18-09-2026
   PublishedVulnerability first disclosed.
2. 22-09-2026
   Last modifiedVulnerability information updated.

Description

libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, when WITH_UNCOMPRESSED_CODEC is enabled, heif_context_add_image_tile() accepts an independently constructed tile whose component-plane dimensions do not match the tile geometry established by the prototype image. ImageItem_uncompressed::add_image_tile() passes that tile directly to unc_encoder::encode_tile(), which lacked the check_component_sizes() gate and sizes its output from the configured tile geometry while copying the tile's actual component-plane dimensions. An oversized component plane can therefore make unc_encoder_component_interleave::encode_tile() copy attacker-controlled data beyond the heap output buffer. This issue is fixed in version 1.23.2.

• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.