CVE-2026-84449: low-severity vulnerability in strukturag libheif
libheif hOp_RGB24_32_to_YCbCr Memory Access Error / SEGV
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
8Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 3.7epss 0.4%
libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.19.6, Op_RGB24_32_to_YCbCr::convert_colorspace() stores image-plane strides in an integer width that can overflow for extremely large RGB images created through heif_image_create() and heif_image_add_plane(). The resulting wrapped stride causes the conversion loop in libheif/color-conversion/rgb2yuv.cc to compute an invalid input pointer and read beyond the allocated interleaved plane while heif_context_encode_image() performs RGB-to-YCbCr conversion. This can crash the encoding process. This issue is fixed in version 1.19.6.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected products
strukturag · libheifRelated CVEs — strukturag libheif
In the same product, most dangerous first.
CVE-2026-84383CRITICALlibheif: Heap buffer overflow in `scale_nearest_neighbor()` via duplicate Alpha planes from nested `iden`/`auxl` itemsEPSS 0.7%CVE-2026-32882HIGHlibheif: Heap Buffer OOB Read in overlay compositing due to wrong alpha strideEPSS 0.7%CVE-2026-32740HIGHlibheif: Heap-Buffer-Overflow Write in Grid Tile Chroma CompositingEPSS 0.7%CVE-2026-50142HIGHlibheif: unbounded heap allocation in HEIF sequence parser (stsz fixed-size mode missing bound check)EPSS 0.7%CVE-2026-62292HIGHlibheif: Out-of-bounds read in uncompressed unci tile range slicingEPSS 0.6%CVE-2026-84447HIGHlibheif: Derived-image indirect reference chains and tiled offsets bypass decode caching and MemoryHandle limits, causing CPU/memory amplification DoSEPSS 0.5%