CVE-2026-84450: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-84450 is a Reachable Assertion vulnerability (CWE-617) in libheif, an open-source HEIF and AVIF file format decoder and encoder maintained by strukturag. Affected versions span from 1.19.0 up to (but not including) 1.23.3. A crafted image item containing a clap property and an ispe width or height greater than INT32_MAX + 1 can trigger an assertion failure in assert-enabled builds, or produce invalid crop geometry in release builds. The vulnerability was published on September 18, 2026, and carries a CVSS v3.1 base score of 4.3 (Medium) (Feedly).

The root cause is classified as CWE-617 (Reachable Assertion). When processing a crafted HEIF image with a clap (clean aperture) property and an ispe (image spatial extents) dimension exceeding INT32_MAX + 1, the code path through heif_image_handle_get_image_tiling() reaches Box_clap::left_rounded() or Box_clap::top_rounded(). These functions pass the image dimension minus one to Fraction::Fraction(), whose uint32_t constructor uses an assertion for input validation rather than a proper bounds check. In assert-enabled (debug) builds, this causes an immediate process abort; in release builds, the assertion is compiled out, allowing invalid crop geometry to be computed — the tiling API then returns dimensions that the normal decode security limits subsequently reject (Feedly).

In assert-enabled builds, exploitation causes an immediate process abort (denial of service). In release builds, the vulnerability results in invalid crop geometry being computed and propagated through the tiling API, where downstream security limits reject the malformed dimensions — limiting the practical impact to availability disruption rather than memory corruption or code execution. There is no demonstrated confidentiality or integrity impact; the CVSS v3.1 vector confirms no confidentiality or integrity loss, with only low availability impact (Feedly).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-84450. The vulnerability requires user interaction (e.g., opening or processing a crafted HEIF/AVIF file), and no privileges are required of the attacker. The CVE status is listed as "Deferred" and no CISA KEV catalog entry exists. The Feedly data records no exploitation events and no PoC entries (Feedly).

1. Craft malicious image: Create a HEIF file containing an ispe box with a width or height value greater than INT32_MAX + 1 (i.e., > 2,147,483,648), paired with a clap (clean aperture) property box.
2. Deliver to target: Distribute the crafted file to a victim application that uses libheif 1.19.0–1.23.2 for image decoding (e.g., via email attachment, web upload, or shared media).
3. Trigger vulnerable code path: Cause the application to call heif_image_handle_get_image_tiling() on the crafted image, which routes through Box_clap::left_rounded() or Box_clap::top_rounded().
4. Achieve denial of service: In assert-enabled builds, the uint32_t constructor assertion fires and the process aborts. In release builds, invalid crop geometry is computed and the tiling API returns dimensions rejected by security limits, disrupting normal processing (Feedly).

• Logs: Application crash logs or core dumps referencing heif_image_handle_get_image_tiling(), Box_clap::left_rounded(), or Box_clap::top_rounded() in the stack trace; assertion failure messages from libheif in debug builds.
• Process: Unexpected process termination (SIGABRT in debug builds) of applications using libheif when processing HEIF/AVIF files; abnormal exit codes from image processing pipelines.
• File System: Presence of crafted HEIF/AVIF files with unusually large ispe dimension values (width or height > 2,147,483,648) in upload directories or processing queues.

The fix is available in libheif version 1.23.3, which addresses the improper assertion-based input validation in the Fraction::Fraction() constructor. All users running libheif 1.19.0 through 1.23.2 should upgrade to 1.23.3 immediately. No configuration-based workaround has been published; upgrading is the only recommended remediation (Feedly).