libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.2, crafted HEIF or AVIF mime metadata and unci image data can cause decompress_brotli() and do_inflate() to grow accumulated output without an effective size limit or MemoryHandle accounting. The brotli path has no output bound, while the zlib path checks only a small temporary buffer in a branch that valid streams do not reach, and overlapping icef units can decompress the same payload repeatedly. HeifContext::interpret_heif_file_images() processes multiple compressed metadata items during file opening, allowing a small file to consume unbounded memory and terminate the process. This issue is fixed in version 1.23.2.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.2, crafted HEIF or AVIF
    mime metadata and unci image data can cause decompress_brotli() and do_inflate() to grow accumulated
    output without an effective size limit or MemoryHandle accounting. The brotli path has no output bound,
    while the zlib path checks only a small temporary buffer in a branch that valid streams do not reach, and
    overlapping icef units can decompress the same payload repeatedly.
    HeifContext::interpret_heif_file_images() processes multiple compressed metadata items during file
    opening, allowing a small file to consume unbounded memory and terminate the process. This issue is fixed
    in version 1.23.2. (CVE-2026-84384)

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8846-1 advisory.

    Yuqi Qiu and Xiang Li discovered that libheif incorrectly handled certain compressed metadata. A remote     attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 24.04     LTS and Ubuntu 26.04 LTS. (CVE-2026-84384)

    Yuqi Qiu and Xiang Li discovered that libheif incorrectly handled certain HEIF sequence data. A remote     attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 26.04     LTS. (CVE-2026-84446)

    Yuqi Qiu and Xiang Li discovered that libheif incorrectly handled certain image references. A remote     attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 26.04     LTS. (CVE-2026-84447)

    It was discovered that libheif incorrectly handled certain region masks. A local attacker could possibly     use this issue to obtain sensitive information or cause a denial of service. This issue only affected     Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-84448)

    It was discovered that libheif incorrectly handled certain images. A remote attacker could possibly use     this issue to cause a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS,     Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. (CVE-2026-84449)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-022ff83e3e advisory.

    Latest security bugfix release from upstream. Changes:
    https://github.com/strukturag/libheif/releases/tag/v1.23.5 .


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21889-1 advisory.

    - CVE-2026-84383: Heap buffer overflow in scale_nearest_neighbor() via duplicate alpha planes from nested     iden/auxl       items (bsc#1279443).
    - CVE-2026-84384: brotli/zlib decompression paths lack output-size limits, allowing decompression-bomb     OOM/DoS       (bsc#1279445).
    - CVE-2026-84444: Out-of-bounds write in the unci encoder (bsc#1279448).
    - CVE-2026-84446: Sequence decode timing-table initialization allows non-terminating loops and unbounded     memory,       bypassing max_sequence_frames (bsc#1279447).
    - CVE-2026-84447: Derived-image indirect reference chains and tiled offsets bypass decode caching and     MemoryHandle       limits, causing CPU/memory amplification DoS (bsc#1279446).
    - CVE-2026-84448: Heap out-of-bounds read in the inline-mask region API (bsc#1279449).
    - CVE-2026-84450: image item with `clap` property and an ispe declaring a dimension greater than     `INT32_MAX + 1` can       lead to a crash via an abort (bsc#1280002).
    - CVE-2026-84451: crafted HEIF file advertising a 4096 ? 4096 uncompressed tile grid can cause an out-of-     bounds read due       to an integer overflow (bsc#1280001).
    - Heap out-of-bounds write in the uncompressed encoder for RRGGBB images with interleaved bit-depth <= 8     (bsc#1273083).
    - Out-of-bounds read and write in derived-item and pixel-plane handling (bsc#1279444).

    Changes for libheif:

    - Update to version 1.23.4:
     * CVE-2026-XXXXX: The max_items security limit was not enforced      for the child boxes of iinf, so a file could declare an      unbounded number of items.
     * CVE-2026-XXXXX: Unbounded recursion in the reference-cycle      check crashed the parser on a long chain of derived items,      without bound when the item-count limit is disabled.
     * CVE-2026-XXXXX: Permanent decoder deadlock through a lock-order      inversion in parallel grid tile decoding (enabled by default).
     * CVE-2026-XXXXX: Heap out-of-bounds read in the encoder pluginsi      for images whose luma and chroma bit depths differ.
     * CVE-2026-XXXXX: Unreclaimable memory leak in      heif_track_get_next_raw_sequence_sample().
     * CVE-2026-XXXXX: Heap out-of-bounds read in the WebCodecs      decoder plugin
    - includes fixes from 1.23.3:
     * CVE-2026-XXXXX: Heap buffer overflow (write) in the      uncompressed (unci) mixed-interleave decoder when the two      chroma components declare different bit depths.
     * CVE-2026-XXXXX: Permanent decoder deadlock through a reference      cycle between an image and its alpha auxiliary image.
     * CVE-2026-XXXXX: Heap out-of-bounds read in the YCbCr 4:2:0 to      16-bit interleaved RGB conversion when the chroma planes have a      lower bit depth than luma
     * CVE-2026-XXXXX: Heap buffer overflow in the SVT-AV1 encoder      plugin when encoding a high-bit-depth alpha channel, and a      double free on its send-picture error path.
     * CVE-2026-84451: Incomplete fix: the tile range check of the      unci decoder (without icef) could still overflow, allowing an      out-of-bounds read
     * CVE-2026-XXXXX: Heap out-of-bounds read when converting odd-      height 4:2:0 frames of an uncompressed (uncv) image sequence to      RGB.
     * CVE-2026-XXXXX: Out-of-bounds read in the RGB to YCbCr identity-      matrix color conversion when the R, G, and B planes have      different bit depths
     * CVE-2026-84450: A clap property combined with an oversized ispe      reached an assert() in the Fraction arithmetic and aborted the      process (incomplete fix). An error is returned instead.
     * Fix Several smaller findings
     * Fix Undefined behavior (negative shift) in the HDR bit-depth      up-conversion for target bit depths above 16. Such conversions      are now rejected.
     * A number of bug fixes
    - Update to version 1.23.2: [jsc#PED-16355]
     * CVE-2026-84383: Heap buffer overflow in      scale_nearest_neighbor() via duplicate alpha planes from      nested iden/auxl items. (boo#CVE-2026-84383)
     * Out-of-bounds read and write in derived-item and pixel-plane      handling. Through iden and auxl item chains, a crafted file      could attach pixel planes whose size differs from the image      geometry; crop, scale, and plane-extraction code then indexed      those planes with the wrong size. A working code-execution      exploit was confirmed. Plane sizes are now validated wherever      they are consumed. (boo#1279444)
     * CVE-2026-84384: brotli/zlib decompression of mime metadata      and unci image data had no effective output-size limit, so a      decompression bomb could exhaust memory. Decompressed output      is now bounded by the security limits. (boo#1279445)
     * CVE-2026-84447: Chains of derived-image references (grid,      iovl, iden) bypassed decode caching and memory limits, causing      CPU and memory amplification. (boo#1279446)
     * CVE-2026-84446: Sequence sample-timing initialization could      produce non-terminating decode loops and unbounded memory,      bypassing max_sequence_frames. (boo#1279447)
     * CVE-2026-84444: Out-of-bounds write in the unci encoder when      heif_context_add_image_tile() is given a tile whose planes do      not match its declared size. (boo#1279448)
     * CVE-2026-84448: Heap out-of-bounds read in the inline-mask      region API when mask_data_len does not match the region      geometry. (boo#1279449)
     * C++ exceptions such as std::bad_alloc can no longer escape the      C API read/decode entry points; they are returned as a      heif_error instead of aborting the process
     * assert()s in the pixel-image plane allocation were replaced by      runtime errors
     * stts/ctts tables describing more samples than the track can      have are rejected
     * pclr (JPEG 2000 palette) box: the number of palette entries is      bounded by the box size
     * BitReader::skip_bytes() is now constant time (fixes a fuzzer      timeout on bogus alignment values)
     * iden items now validate the decoded image size like all other      items
     * The uncompressed (unci) encoder rejects images without pixel      planes
     * meta, mini, and moov boxes with size 0 (extending to the end of      the file) are now parsed correctly
     * Fixed an integer overflow when probing the file size
     * Fixed undefined behavior (signed shift) when reading the NAL      unit length in the OpenH264 decoder
     * heif_region_item_add_region_inline_mask_data() now requires      non-zero width and height and the mask_data_len must equal      the expected (width * height + 7) / 8; otherwise it returns      an error instead of storing the mask
     * heif_image_add_plane() returns an error instead of aborting      for bit depths outside 1..128 or interleaved component counts      outside 1..255

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4276-1 advisory.

    - CVE-2026-84383: Heap buffer overflow in scale_nearest_neighbor() via duplicate alpha planes from nested     iden/auxl       items (bsc#1279443).
    - CVE-2026-84384: brotli/zlib decompression paths lack output-size limits, allowing decompression-bomb     OOM/DoS       (bsc#1279445).
    - CVE-2026-84444: Out-of-bounds write in the unci encoder (bsc#1279448).
    - CVE-2026-84446: Sequence decode timing-table initialization allows non-terminating loops and unbounded     memory,       bypassing max_sequence_frames (bsc#1279447).
    - CVE-2026-84447: Derived-image indirect reference chains and tiled offsets bypass decode caching and     MemoryHandle       limits, causing CPU/memory amplification DoS (bsc#1279446).
    - CVE-2026-84448: Heap out-of-bounds read in the inline-mask region API (bsc#1279449).
    - CVE-2026-84450: image item with `clap` property and an ispe declaring a dimension greater than     `INT32_MAX + 1` can       lead to a crash via an abort (bsc#1280002).
    - CVE-2026-84451: crafted HEIF file advertising a 4096 x 4096 uncompressed tile grid can cause an out-of-     bounds read due       to an integer overflow (bsc#1280001).
    - Out-of-bounds read and write in derived-item and pixel-plane handling (bsc#1279444).

    Changes for libheif:

    - Update to version 1.23.4 (jsc#PED-16355)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.2, crafted HEIF or AVIF     mime metadata and unci image data can cause decompress_brotli() and do_inflate() to grow accumulated     output without an effective size limit or MemoryHandle accounting. The brotli path has no output bound,     while the zlib path checks only a small temporary buffer in a branch that valid streams do not reach, and     overlapping icef units can decompress the same payload repeatedly.
    HeifContext::interpret_heif_file_images() processes multiple compressed metadata items during file     opening, allowing a small file to consume unbounded memory and terminate the process. This issue is fixed     in version 1.23.2. (CVE-2026-84384)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
472794	Echo: libheif: security update to 1.23.2-1	Tenable Cloud Security	Echo Local Security Checks	Local	high
472794	Echo: libheif: security update to 1.23.2-1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
353447	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : libheif vulnerabilities (USN-8846-1)	Nessus	Ubuntu Local Security Checks	Local	medium
350757	Fedora 43 : libheif (2026-022ff83e3e)	Nessus	Fedora Local Security Checks	Local	medium
350154	openSUSE 16: gdk-pixbuf-loader-libheif / libheif-aom / libheif-dav1d / etc (openSUSE-SU-2026:21889-1)	Nessus	SuSE Local Security Checks	Local	critical
348723	SUSE SLED15: gdk-pixbuf-loader-libheif / libheif-aom / libheif-dav1d / etc (SUSE-SU-2026:4276-1)	Nessus	SuSE Local Security Checks	Local	critical
348316	Linux Distros Unpatched Vulnerability : CVE-2026-84384	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-84384

high

Tenable Plugins

high

high

medium

medium

critical

critical

high