Heap-based buffer overflow in libheif - CVE-2026-84383

Vulnerability identifier: #VU145248

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-84383

CWE-ID: CWE-122

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in HeifPixelImage::scale_nearest_neighbor() when parsing a crafted HEIC, HEIF, or AVIF file with nested iden and auxl item references that create duplicate Alpha planes. A remote attacker can supply a specially crafted file to execute arbitrary code.

Any application using heif_decode_image() is affected, and no special API options or unusual calling patterns are required.

libheif
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
Desktop Applications Module
SUSE Package Hub 15
libheif-dav1d
libheif-aom
libheif-debugsource
libheif-jpeg
libheif1-debuginfo
libheif-dav1d-debuginfo
libheif-jpeg-debuginfo
libheif-rav1e-debuginfo
libheif-rav1e
libheif-aom-debuginfo
libheif1
libheif-devel
gdk-pixbuf-loader-libheif-debuginfo
gdk-pixbuf-loader-libheif
libheif-ffmpeg-debuginfo
libheif-ffmpeg

Install security update from vendor's website.

libheif - update to 1.23.2
libheif-dav1d - update to 1.23.4-150700.3.21.1
libheif-aom - update to 1.23.4-150700.3.21.1
libheif-debugsource - update to 1.23.4-150700.3.21.1
libheif-jpeg - update to 1.23.4-150700.3.21.1
libheif1-debuginfo - update to 1.23.4-150700.3.21.1
libheif-dav1d-debuginfo - update to 1.23.4-150700.3.21.1
libheif-jpeg-debuginfo - update to 1.23.4-150700.3.21.1
libheif-rav1e-debuginfo - update to 1.23.4-150700.3.21.1
libheif-rav1e - update to 1.23.4-150700.3.21.1
libheif-aom-debuginfo - update to 1.23.4-150700.3.21.1
libheif1 - update to 1.23.4-150700.3.21.1
libheif-devel - update to 1.23.4-150700.3.21.1
gdk-pixbuf-loader-libheif-debuginfo - update to 1.23.4-150700.3.21.1
gdk-pixbuf-loader-libheif - update to 1.23.4-150700.3.21.1
libheif-ffmpeg-debuginfo - update to 1.23.4-150700.3.21.1
libheif-ffmpeg - update to 1.23.4-150700.3.21.1

• https://github.com/strukturag/libheif/security/advisories/GHSA-g89c-p67h-r497

• Multiple vulnerabilities in libheif
• SUSE update for libheif