Detections
Analytics

Echo: libheif: security update to 1.19.8-1+e9

medium Tenable Cloud Security Plugin ID 461458

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.3, a crafted image item
 containing a clap property and an ispe width or height greater than INT32_MAX + 1 can reach crop
 calculations through heif_image_handle_get_image_tiling(). Box_clap::left_rounded() or
 Box_clap::top_rounded() passes the image dimension minus one to Fraction::Fraction(), whose uint32_t
 constructor uses an assertion as input validation, causing assert-enabled builds to abort. Release builds
 can instead compute invalid crop geometry, and the tiling API returns dimensions that the normal decode
 security limits reject. This issue is fixed in version 1.23.3. (CVE-2026-84450)

Solution

Update the libheif library and its related packages to version 1.19.8-1+e9 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-84450

Plugin Details

Severity: Medium

ID: 461458

Version: Revision 1.2

Type: Local

Published: 10/2/2026

Updated: 10/5/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 1.2

Percentile: 0.01

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS Score Source: CVE-2026-84450

CVSS v3

Risk Factor: Medium

Base Score: 4.3

Temporal Score: 3.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/4/2026

Vulnerability Publication Date: 9/18/2026

Reference Information

CVE: CVE-2026-84450

IAVB: 2026-B-0281