Out-of-bounds read in libheif - CVE-2026-84449

Vulnerability identifier: #VU146738

CSH Severity: Low

CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-84449

CWE-ID: CWE-125

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in Op_RGB24_32_to_YCbCr::convert_colorspace when encoding an image and converting RGB data to YCbCr. A remote attacker can supply a crafted image with extreme dimensions to trigger a crash and cause a denial of service.

The issue results in a read memory access error and segmentation fault during image encoding.

libheif
openSUSE Leap
Ubuntu
libheif1 (Ubuntu package)
libheif-dev (Ubuntu package)
heif-thumbnailer (Ubuntu package)
heif-gdk-pixbuf (Ubuntu package)
libheif-plugin-x265 (Ubuntu package)
libheif-plugin-aomdec (Ubuntu package)
libheif-plugin-aomenc (Ubuntu package)
libheif-plugin-svtenc (Ubuntu package)
libheif-plugin-rav1e (Ubuntu package)
libheif-plugin-libde265 (Ubuntu package)
libheif-plugin-dav1d (Ubuntu package)
libheif-plugin-jpegenc (Ubuntu package)
libheif-plugin-jpegdec (Ubuntu package)
libheif-plugin-j2kenc (Ubuntu package)
libheif-plugin-j2kdec (Ubuntu package)
libheif-plugin-ffmpegdec (Ubuntu package)
gdk-pixbuf-loader-libheif
libheif1
libheif-debugsource
libheif-devel
libheif1-debuginfo
libheif1-32bit
libheif1-32bit-debuginfo
libheif1-64bit
libheif1-64bit-debuginfo
gdk-pixbuf-loader-libheif-debuginfo

Install security update from vendor's website.

libheif - update to 1.19.6
libheif1 (Ubuntu package) - addressed in versions 1.1.0-2ubuntu0.1~esm5, 1.6.1-1ubuntu0.1~esm5, 1.12.0-2ubuntu0.1~esm5, 1.17.6-1ubuntu4.9
libheif-dev (Ubuntu package) - addressed in versions 1.1.0-2ubuntu0.1~esm5, 1.6.1-1ubuntu0.1~esm5, 1.12.0-2ubuntu0.1~esm5, 1.17.6-1ubuntu4.9
heif-thumbnailer (Ubuntu package) - addressed in versions 1.6.1-1ubuntu0.1~esm5, 1.12.0-2ubuntu0.1~esm5, 1.17.6-1ubuntu4.9
heif-gdk-pixbuf (Ubuntu package) - addressed in versions 1.6.1-1ubuntu0.1~esm5, 1.12.0-2ubuntu0.1~esm5, 1.17.6-1ubuntu4.9
libheif-plugin-x265 (Ubuntu package) - update to 1.17.6-1ubuntu4.9
libheif-plugin-aomdec (Ubuntu package) - update to 1.17.6-1ubuntu4.9
libheif-plugin-aomenc (Ubuntu package) - update to 1.17.6-1ubuntu4.9
libheif-plugin-svtenc (Ubuntu package) - update to 1.17.6-1ubuntu4.9
libheif-plugin-rav1e (Ubuntu package) - update to 1.17.6-1ubuntu4.9
libheif-plugin-libde265 (Ubuntu package) - update to 1.17.6-1ubuntu4.9
libheif-plugin-dav1d (Ubuntu package) - update to 1.17.6-1ubuntu4.9
libheif-plugin-jpegenc (Ubuntu package) - update to 1.17.6-1ubuntu4.9
libheif-plugin-jpegdec (Ubuntu package) - update to 1.17.6-1ubuntu4.9
libheif-plugin-j2kenc (Ubuntu package) - update to 1.17.6-1ubuntu4.9
libheif-plugin-j2kdec (Ubuntu package) - update to 1.17.6-1ubuntu4.9
libheif-plugin-ffmpegdec (Ubuntu package) - update to 1.17.6-1ubuntu4.9
gdk-pixbuf-loader-libheif - update to 1.12.0-150400.3.30.1
libheif1 - update to 1.12.0-150400.3.30.1
libheif-debugsource - update to 1.12.0-150400.3.30.1
libheif-devel - update to 1.12.0-150400.3.30.1
libheif1-debuginfo - update to 1.12.0-150400.3.30.1
libheif1-32bit - update to 1.12.0-150400.3.30.1
libheif1-32bit-debuginfo - update to 1.12.0-150400.3.30.1
libheif1-64bit - update to 1.12.0-150400.3.30.1
libheif1-64bit-debuginfo - update to 1.12.0-150400.3.30.1
gdk-pixbuf-loader-libheif-debuginfo - update to 1.12.0-150400.3.30.1

• https://github.com/strukturag/libheif/security/advisories/GHSA-2c3g-p585-8rpq

• Multiple vulnerabilities in libheif
• Ubuntu update for libheif
• SUSE update for libheif