CVE Feed

    Dashboard / CVE / CVE-2026-84447

    CVE-2026-84447

    libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.1 and earlier, crafted grid, iovl, and iden reference graphs can repeatedly decode the same base image because processed_ids is copied per branch and ImageItem::decode_image() has no shared operation budget. This vulnerability is fixed in 1.23.2.

    Published:Sep 18, 2026
    Last Modified:Sep 19, 2026
    EPS:Sep 18, 2026
    EPSS Score:0.00524
    CVSS Score:7.5

    Affected Products

    Vendor
    Struktur
    Product
    Libheif

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-84450 (CVSS 4.3) — libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.3, a crafted image item con…
    CVE-2026-84449 (CVSS 3.7) — libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.19.6, Op_RGB24_32_to_YCbCr::convert_col…
    CVE-2026-84451 (CVSS 6.5) — libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.3, the no-icef full-item br…
    CVE-2026-84384 (CVSS 7.5) — libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.2, crafted HEIF or AVIF mim…
    CVE-2026-84444 (CVSS 7.4) — libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, when WITH_UNCOMPRESSED_CODEC is e…
    CVE-2026-84383 (CVSS 9.8) — libheif is a HEIF and AVIF file format decoder and encoder. From 1.22.0 until 1.23.2, a crafted HEIF, HEIC, or…
    CVE-2026-84446 (CVSS 7.5) — libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, crafted HEIF sequence timing and …
    CVE-2026-84448 (CVSS 4) — libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, the public heif_region_item_add_r…
    CVE-2026-62377 (CVSS 4.3) — libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF sequence acc…
    CVE-2026-62291 (CVSS 5.3) — libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted image sequence wi…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High