CVE-2026-84450: strukturag libheif Reachable Assertion

Vulnerability summary

CVE-2026-84450 is a medium (CVSS 4.3) Reachable Assertion vulnerability in strukturag libheif. EPSS estimates a 0.28% chance of exploitation in the next 30 days, higher than 19.6% of scored vulnerabilities.

Timeline

1. 18-09-2026
   PublishedVulnerability first disclosed.
2. 21-09-2026
   Last modifiedVulnerability information updated.

Description

libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.3, a crafted image item containing a clap property and an ispe width or height greater than INT32_MAX + 1 can reach crop calculations through heif_image_handle_get_image_tiling(). Box_clap::left_rounded() or Box_clap::top_rounded() passes the image dimension minus one to Fraction::Fraction(), whose uint32_t constructor uses an assertion as input validation, causing assert-enabled builds to abort. Release builds can instead compute invalid crop geometry, and the tiling API returns dimensions that the normal decode security limits reject. This issue is fixed in version 1.23.3.

• CWE-617Reachable AssertionThe product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.