CVE catalog

CVE-2026-84383

libheif: CVE-2026-84383

Severity: Critical · CVSS 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published: Sep 4, 2026, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 0.72% · Oct 25, 2026

libheif is a HEIF and AVIF file format decoder and encoder. From 1.22.0 until 1.23.2, a crafted HEIF, HEIC, or AVIF item graph using nested iden and auxl references can make HeifPixelImage::transfer_channel_from_image_as() append duplicate Alpha planes with different bit depths to m_storage. HeifPixelImage::scale_nearest_neighbor() in libheif/image/pixelimage.cc allocates the destination Alpha plane using the first plane's 8-bit depth, then iterates a later 10-bit or 12-bit Alpha component and writes uint16_t samples into the same 8-bit allocation. The output geometry controls the overflow extent and the encoded sample values control the data written, allowing a remote file processed by heif_decode_image() to cause a heap out-of-bounds write. This issue is fixed in version 1.23.2.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	libheif	sid	`1.23.6-2`	fixed
Debian	libheif	forky	`1.23.6-2`	fixed
Debian	libheif	trixie	`1.19.8-1+deb13u1`	not affected
Debian	libheif	trixie-security	`1.23.6-2~deb13u1`	not affected
Debian	libheif	bookworm	`1.15.1-1+deb12u1`	not affected
Debian	libheif	bookworm-security	`1.15.1-1+deb12u1`	not affected
Opensuse	libheif	leap 16.0	`1.23.4-160000.1.1`	fixed
Suse	libheif	linux enterprise module for desktop applications 15 sp7	`1.23.4-150700.3.21.1`	fixed
Suse	libheif	linux enterprise module for package hub 15 sp7	`1.23.4-150700.3.21.1`	fixed
Opensuse	libheif	tumbleweed	`1.23.4-1.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	libheif	source	sid	`1.23.2-1`	not yet assigned	Not reported	Not reported
Debian	libheif	source	forky	`1.23.2-1`	not yet assigned	Not reported	Not reported
Debian	libheif	source	trixie	`Not affected`	unimportant	Not reported	Not reported
Debian	libheif	source	bookworm	`Not affected`	unimportant	Not reported	Not reported
Opensuse	libheif	rpm	leap 16.0	`1.23.4-160000.1.1`	Not reported	OPENSUSE-SU-2026:21889-1	Not reported
Suse	libheif	rpm	linux enterprise module for desktop applications 15 sp7	`1.23.4-150700.3.21.1`	Not reported	SUSE-SU-2026:4276-1	Not reported
Suse	libheif	rpm	linux enterprise module for package hub 15 sp7	`1.23.4-150700.3.21.1`	Not reported	SUSE-SU-2026:4276-1	Not reported
Opensuse	libheif	rpm	tumbleweed	`1.23.4-1.1`	Not reported	OPENSUSE-SU-2026:11719-1	Not reported

OpenFactory catalog packages

[openSUSE Tumbleweed]

[gdk-pixbuf-loader-libheif]Unknown
Source package: [libheif]
Details (1)
- 1.23.1-2.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.23.4-1.1
  Version impact unknown
  dsa · libheif · opensuse · tumbleweed
[libheif1]Unknown
Source package: [libheif]
Details (1)
- 1.23.1-2.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.23.4-1.1
  Version impact unknown
  dsa · libheif · opensuse · tumbleweed
[libheif1-32bit]Unknown
Source package: [libheif]
Details (1)
- 1.23.1-2.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.23.4-1.1
  Version impact unknown
  dsa · libheif · opensuse · tumbleweed
[libheif-aom]Unknown
Source package: [libheif]
Details (1)
- 1.23.1-2.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.23.4-1.1
  Version impact unknown
  dsa · libheif · opensuse · tumbleweed
[libheif-dav1d]Unknown
Source package: [libheif]
Details (1)
- 1.23.1-2.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.23.4-1.1
  Version impact unknown
  dsa · libheif · opensuse · tumbleweed
[libheif-devel]Unknown
Source package: [libheif]
Details (1)
- 1.23.1-2.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.23.4-1.1
  Version impact unknown
  dsa · libheif · opensuse · tumbleweed
[libheif-ffmpeg]Unknown
Source package: [libheif]
Details (1)
- 1.23.1-2.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.23.4-1.1
  Version impact unknown
  dsa · libheif · opensuse · tumbleweed
[libheif-jpeg]Unknown
Source package: [libheif]
Details (1)
- 1.23.1-2.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.23.4-1.1
  Version impact unknown
  dsa · libheif · opensuse · tumbleweed
[libheif-openh264]Unknown
Source package: [libheif]
Details (1)
- 1.23.1-2.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.23.4-1.1
  Version impact unknown
  dsa · libheif · opensuse · tumbleweed
[libheif-openjpeg]Unknown
Source package: [libheif]
Details (1)
- 1.23.1-2.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.23.4-1.1
  Version impact unknown
  dsa · libheif · opensuse · tumbleweed
[libheif-rav1e]Unknown
Source package: [libheif]
Details (1)
- 1.23.1-2.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.23.4-1.1
  Version impact unknown
  dsa · libheif · opensuse · tumbleweed
[libheif-svtenc]Unknown
Source package: [libheif]
Details (1)
- 1.23.1-2.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.23.4-1.1
  Version impact unknown
  dsa · libheif · opensuse · tumbleweed

[Debian 12 (Bookworm)]

[heif-gdk-pixbuf]Not affected
Source package: [libheif]
Details (6)
- 1.15.1-1+deb12u1 · amd64 · bookworm
  Not affected
  dsa · libheif · debian · bookworm
- 1.15.1-1+deb12u1 · arm64 · bookworm
  Not affected
  dsa · libheif · debian · bookworm
- 1.19.7-1~bpo12+1 · amd64 · bookworm-backports
  Not affected
  dsa · libheif · debian · bookworm
- 1.19.7-1~bpo12+1 · arm64 · bookworm-backports
  Not affected
  dsa · libheif · debian · bookworm
- 1.15.1-1+deb12u1 · amd64 · bookworm-security
  Not affected
  dsa · libheif · debian · bookworm
- 1.15.1-1+deb12u1 · arm64 · bookworm-security
  Not affected
  dsa · libheif · debian · bookworm
[heif-thumbnailer]Not affected
Source package: [libheif]
Details (6)
- 1.15.1-1+deb12u1 · amd64 · bookworm
  Not affected
  dsa · libheif · debian · bookworm
- 1.15.1-1+deb12u1 · arm64 · bookworm
  Not affected
  dsa · libheif · debian · bookworm
- 1.19.7-1~bpo12+1 · amd64 · bookworm-backports
  Not affected
  dsa · libheif · debian · bookworm
- 1.19.7-1~bpo12+1 · arm64 · bookworm-backports
  Not affected
  dsa · libheif · debian · bookworm
- 1.15.1-1+deb12u1 · amd64 · bookworm-security
  Not affected
  dsa · libheif · debian · bookworm
- 1.15.1-1+deb12u1 · arm64 · bookworm-security
  Not affected
  dsa · libheif · debian · bookworm
[libheif1]Not affected
Source package: [libheif]
Details (6)
- 1.15.1-1+deb12u1 · amd64 · bookworm
  Not affected
  dsa · libheif · debian · bookworm
- 1.15.1-1+deb12u1 · arm64 · bookworm
  Not affected
  dsa · libheif · debian · bookworm
- 1.19.7-1~bpo12+1 · amd64 · bookworm-backports
  Not affected
  dsa · libheif · debian · bookworm
- 1.19.7-1~bpo12+1 · arm64 · bookworm-backports
  Not affected
  dsa · libheif · debian · bookworm
- 1.15.1-1+deb12u1 · amd64 · bookworm-security
  Not affected
  dsa · libheif · debian · bookworm
- 1.15.1-1+deb12u1 · arm64 · bookworm-security
  Not affected
  dsa · libheif · debian · bookworm
[libheif-dev]Not affected
Source package: [libheif]
Details (6)
- 1.15.1-1+deb12u1 · amd64 · bookworm
  Not affected
  dsa · libheif · debian · bookworm
- 1.15.1-1+deb12u1 · arm64 · bookworm
  Not affected
  dsa · libheif · debian · bookworm
- 1.19.7-1~bpo12+1 · amd64 · bookworm-backports
  Not affected
  dsa · libheif · debian · bookworm
- 1.19.7-1~bpo12+1 · arm64 · bookworm-backports
  Not affected
  dsa · libheif · debian · bookworm
- 1.15.1-1+deb12u1 · amd64 · bookworm-security
  Not affected
  dsa · libheif · debian · bookworm
- 1.15.1-1+deb12u1 · arm64 · bookworm-security
  Not affected
  dsa · libheif · debian · bookworm
[libheif-examples]Not affected
Source package: [libheif]
Details (6)
- 1.15.1-1+deb12u1 · amd64 · bookworm
  Not affected
  dsa · libheif · debian · bookworm
- 1.15.1-1+deb12u1 · arm64 · bookworm
  Not affected
  dsa · libheif · debian · bookworm
- 1.19.7-1~bpo12+1 · amd64 · bookworm-backports
  Not affected
  dsa · libheif · debian · bookworm
- 1.19.7-1~bpo12+1 · arm64 · bookworm-backports
  Not affected
  dsa · libheif · debian · bookworm
- 1.15.1-1+deb12u1 · amd64 · bookworm-security
  Not affected
  dsa · libheif · debian · bookworm
- 1.15.1-1+deb12u1 · arm64 · bookworm-security
  Not affected
  dsa · libheif · debian · bookworm
[libheif-plugin-aomdec]Not affected
Source package: [libheif]
Details (2)
- 1.19.7-1~bpo12+1 · amd64 · bookworm-backports
  Not affected
  dsa · libheif · debian · bookworm
- 1.19.7-1~bpo12+1 · arm64 · bookworm-backports
  Not affected
  dsa · libheif · debian · bookworm
[libheif-plugin-aomenc]Not affected
Source package: [libheif]
Details (2)
- 1.19.7-1~bpo12+1 · amd64 · bookworm-backports
  Not affected
  dsa · libheif · debian · bookworm
- 1.19.7-1~bpo12+1 · arm64 · bookworm-backports
  Not affected
  dsa · libheif · debian · bookworm
[libheif-plugin-dav1d]Not affected
Source package: [libheif]
Details (2)
- 1.19.7-1~bpo12+1 · amd64 · bookworm-backports
  Not affected
  dsa · libheif · debian · bookworm
- 1.19.7-1~bpo12+1 · arm64 · bookworm-backports
  Not affected
  dsa · libheif · debian · bookworm

Next results

Observed: Oct 27, 2026, 6:55:48 AM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]