openSUSE 16: gdk-pixbuf-loader-libheif / libheif-aom / libheif-dav1d / etc (openSUSE-SU-2026:21889-1)

critical Nessus Plugin ID 350154

Synopsis

The remote openSUSE host is missing one or more security updates.

Description

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21889-1 advisory.

- CVE-2026-84383: Heap buffer overflow in scale_nearest_neighbor() via duplicate alpha planes from nested iden/auxl items (bsc#1279443).
- CVE-2026-84384: brotli/zlib decompression paths lack output-size limits, allowing decompression-bomb OOM/DoS (bsc#1279445).
- CVE-2026-84444: Out-of-bounds write in the unci encoder (bsc#1279448).
- CVE-2026-84446: Sequence decode timing-table initialization allows non-terminating loops and unbounded memory, bypassing max_sequence_frames (bsc#1279447).
- CVE-2026-84447: Derived-image indirect reference chains and tiled offsets bypass decode caching and MemoryHandle limits, causing CPU/memory amplification DoS (bsc#1279446).
- CVE-2026-84448: Heap out-of-bounds read in the inline-mask region API (bsc#1279449).
- CVE-2026-84450: image item with `clap` property and an ispe declaring a dimension greater than `INT32_MAX + 1` can lead to a crash via an abort (bsc#1280002).
- CVE-2026-84451: crafted HEIF file advertising a 4096 ? 4096 uncompressed tile grid can cause an out-of- bounds read due to an integer overflow (bsc#1280001).
- Heap out-of-bounds write in the uncompressed encoder for RRGGBB images with interleaved bit-depth <= 8 (bsc#1273083).
- Out-of-bounds read and write in derived-item and pixel-plane handling (bsc#1279444).

Changes for libheif:

- Update to version 1.23.4:
* CVE-2026-XXXXX: The max_items security limit was not enforced for the child boxes of iinf, so a file could declare an unbounded number of items.
* CVE-2026-XXXXX: Unbounded recursion in the reference-cycle check crashed the parser on a long chain of derived items, without bound when the item-count limit is disabled.
* CVE-2026-XXXXX: Permanent decoder deadlock through a lock-order inversion in parallel grid tile decoding (enabled by default).
* CVE-2026-XXXXX: Heap out-of-bounds read in the encoder pluginsi for images whose luma and chroma bit depths differ.
* CVE-2026-XXXXX: Unreclaimable memory leak in heif_track_get_next_raw_sequence_sample().
* CVE-2026-XXXXX: Heap out-of-bounds read in the WebCodecs decoder plugin
- includes fixes from 1.23.3:
* CVE-2026-XXXXX: Heap buffer overflow (write) in the uncompressed (unci) mixed-interleave decoder when the two chroma components declare different bit depths.
* CVE-2026-XXXXX: Permanent decoder deadlock through a reference cycle between an image and its alpha auxiliary image.
* CVE-2026-XXXXX: Heap out-of-bounds read in the YCbCr 4:2:0 to 16-bit interleaved RGB conversion when the chroma planes have a lower bit depth than luma
* CVE-2026-XXXXX: Heap buffer overflow in the SVT-AV1 encoder plugin when encoding a high-bit-depth alpha channel, and a double free on its send-picture error path.
* CVE-2026-84451: Incomplete fix: the tile range check of the unci decoder (without icef) could still overflow, allowing an out-of-bounds read
* CVE-2026-XXXXX: Heap out-of-bounds read when converting odd- height 4:2:0 frames of an uncompressed (uncv) image sequence to RGB.
* CVE-2026-XXXXX: Out-of-bounds read in the RGB to YCbCr identity- matrix color conversion when the R, G, and B planes have different bit depths
* CVE-2026-84450: A clap property combined with an oversized ispe reached an assert() in the Fraction arithmetic and aborted the process (incomplete fix). An error is returned instead.
* Fix Several smaller findings
* Fix Undefined behavior (negative shift) in the HDR bit-depth up-conversion for target bit depths above 16. Such conversions are now rejected.
* A number of bug fixes
- Update to version 1.23.2: [jsc#PED-16355]
* CVE-2026-84383: Heap buffer overflow in scale_nearest_neighbor() via duplicate alpha planes from nested iden/auxl items. (boo#CVE-2026-84383)
* Out-of-bounds read and write in derived-item and pixel-plane handling. Through iden and auxl item chains, a crafted file could attach pixel planes whose size differs from the image geometry; crop, scale, and plane-extraction code then indexed those planes with the wrong size. A working code-execution exploit was confirmed. Plane sizes are now validated wherever they are consumed. (boo#1279444)
* CVE-2026-84384: brotli/zlib decompression of mime metadata and unci image data had no effective output-size limit, so a decompression bomb could exhaust memory. Decompressed output is now bounded by the security limits. (boo#1279445)
* CVE-2026-84447: Chains of derived-image references (grid, iovl, iden) bypassed decode caching and memory limits, causing CPU and memory amplification. (boo#1279446)
* CVE-2026-84446: Sequence sample-timing initialization could produce non-terminating decode loops and unbounded memory, bypassing max_sequence_frames. (boo#1279447)
* CVE-2026-84444: Out-of-bounds write in the unci encoder when heif_context_add_image_tile() is given a tile whose planes do not match its declared size. (boo#1279448)
* CVE-2026-84448: Heap out-of-bounds read in the inline-mask region API when mask_data_len does not match the region geometry. (boo#1279449)
* C++ exceptions such as std::bad_alloc can no longer escape the C API read/decode entry points; they are returned as a heif_error instead of aborting the process
* assert()s in the pixel-image plane allocation were replaced by runtime errors
* stts/ctts tables describing more samples than the track can have are rejected
* pclr (JPEG 2000 palette) box: the number of palette entries is bounded by the box size
* BitReader::skip_bytes() is now constant time (fixes a fuzzer timeout on bogus alignment values)
* iden items now validate the decoded image size like all other items
* The uncompressed (unci) encoder rejects images without pixel planes
* meta, mini, and moov boxes with size 0 (extending to the end of the file) are now parsed correctly
* Fixed an integer overflow when probing the file size
* Fixed undefined behavior (signed shift) when reading the NAL unit length in the OpenH264 decoder
* heif_region_item_add_region_inline_mask_data() now requires non-zero width and height and the mask_data_len must equal the expected (width * height + 7) / 8; otherwise it returns an error instead of storing the mask
* heif_image_add_plane() returns an error instead of aborting for bit depths outside 1..128 or interleaved component counts outside 1..255

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

Plugin Details

Severity: Critical

ID: 350154

File Name: openSUSE-2026-21889-1.nasl

Version: 1.1

Type: Local

Agent: unix

Family: SuSE Local Security Checks

Published: 9/25/2026

Updated: 9/25/2026

Supported Sensors: Nessus Agent, Continuous Assessment, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.28

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-84383

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:novell:opensuse:16.0, p-cpe:/a:novell:opensuse:gdk-pixbuf-loader-libheif, p-cpe:/a:novell:opensuse:libheif-aom, p-cpe:/a:novell:opensuse:libheif-dav1d, p-cpe:/a:novell:opensuse:libheif-devel, p-cpe:/a:novell:opensuse:libheif-ffmpeg, p-cpe:/a:novell:opensuse:libheif-jpeg, p-cpe:/a:novell:opensuse:libheif-openh264, p-cpe:/a:novell:opensuse:libheif-openjpeg, p-cpe:/a:novell:opensuse:libheif-rav1e, p-cpe:/a:novell:opensuse:libheif-svtenc, p-cpe:/a:novell:opensuse:libheif1

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 9/20/2026

Vulnerability Publication Date: 9/17/2026

Reference Information

CVE: CVE-2026-84383, CVE-2026-84384, CVE-2026-84444, CVE-2026-84446, CVE-2026-84447, CVE-2026-84448, CVE-2026-84450, CVE-2026-84451

IAVB: 2026-B-0259

Detections

Analytics