CVE-2026-84451: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-84451 is an out-of-bounds read vulnerability in libheif, a HEIF and AVIF file format decoder/encoder maintained by strukturag. It represents an incomplete remediation of CVE-2026-62292 (GHSA-73p7-m7gg-w2jv): while the prior fix applied overflow-safe range validation to the icef branch of unc_decoder::get_compressed_image_data_uncompressed(), the sibling no-icef full-item branch retained the same addition-based range check susceptible to integer overflow. Affected versions span 1.19.0 through 1.23.2; the issue is fixed in version 1.23.3. It carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory).

The root cause is an integer overflow (CWE-125: Out-of-bounds Read) in the no-icef full-item branch of unc_decoder::get_compressed_image_data_uncompressed() in libheif/codecs/uncompressed/unc_decoder.cc. A crafted HEIF file advertising a 4096×4096 uncompressed tile grid causes the final tile's range_start_offset + range_size calculation to wrap around at 2^64 to zero, bypassing the bounds check and allowing memcpy() to be called with an invalid source pointer and a ~1 TiB length. The vulnerable arithmetic in fetch_tile_data() computes tile_start_offset = sizes[0] * tileIdx, where a tile index of 16,777,215 (2^24 - 1) and a tile size of 2^40 bytes yields range_start_offset = 2^64 - 2^40; adding range_size = 2^40 overflows to zero, making the check 0 > data->size() false. The fix requires replacing the addition-form check with the subtraction-form guard already used in the patched icef sibling branch (GitHub Advisory).

Successful exploitation causes a reliable denial of service (SIGSEGV / crash) in any application that enumerates and decodes advertised uncompressed image tiles via the public heif_image_handle_decode_image_tile() API. Affected use cases include tile extraction services, progressive tiled-image viewers, server-side HEIF processing pipelines, and thumbnail generators. No confidentiality impact, out-of-bounds write, or remote code execution has been demonstrated; applications using only whole-image decoding are not claimed to reach the vulnerable code path (GitHub Advisory).

A proof-of-concept (PoC) was included in the security advisory and confirmed to reliably crash libheif v1.23.1 in three of three replays, with AddressSanitizer confirming a read fault in memcpy(). Exploitation requires user interaction — a victim application must open and tile-decode a crafted HEIF file — but requires no authentication or special privileges. No in-the-wild exploitation has been reported, no CISA KEV listing exists, and no EPSS score is currently available for this CVE (GitHub Advisory).

1. Craft malicious HEIF file: Generate a HEIF file advertising a 4096×4096 uncompressed tile grid with a minimal (e.g., 1-byte) compressed payload, such that the final tile's computed range_start_offset is 2^64 - 2^40 and range_size is 2^40.
2. Trigger tile decoding: Deliver the crafted file to a target application that uses libheif's tile API (e.g., a thumbnail service, image viewer, or converter). The application must call heif_image_handle_decode_image_tile() for the final advertised tile (tile_x = num_columns - 1, tile_y = num_rows - 1).
3. Integer overflow bypasses bounds check: Inside unc_decoder::get_compressed_image_data_uncompressed(), the addition range_start_offset + range_size overflows uint64_t to zero; the check 0 > data->size() evaluates to false, bypassing validation.
4. Out-of-bounds read / crash: memcpy() is called with an invalid source pointer (data->data() + (2^64 - 2^40)) and a ~1 TiB length, causing SIGSEGV and crashing the application (GitHub Advisory).

• Process: Application process (image viewer, thumbnailer, converter, or server-side pipeline using libheif) terminates unexpectedly with exit status 139 (SIGSEGV).
• Logs: Crash reports or core dumps referencing unc_decoder::get_compressed_image_data_uncompressed(), unc_decoder::fetch_tile_data(), or heif_image_handle_decode_image_tile() in the stack trace; AddressSanitizer output showing SEGV caused by a READ memory access in memcpy().
• File System: Presence of crafted HEIF files with unusually large advertised tile grid dimensions (e.g., 4096×4096 tiles) and anomalously small actual payload sizes.
• Network: Repeated delivery of HEIF files to image-processing endpoints followed by service crashes or restarts (GitHub Advisory).

Upgrade libheif to version 1.23.3, which applies the subtraction-form overflow-safe range guard to the no-icef full-item branch, mirroring the fix already present in the icef branch. Note that libheif 1.23.1, previously listed as patched for CVE-2026-62292, remains vulnerable and should not be treated as a safe version. As a workaround where upgrading is not immediately possible, disable or sandbox tile-based HEIF decoding workflows, or reject HEIF files with uncompressed tile grids at the application layer (GitHub Advisory).

The vulnerability was reported by researchers identified as the-vibe-dev, hillalee, and sonicnew via GitHub's private security advisory process. The strukturag maintainer (farindk) published the advisory on September 1, 2026, explicitly noting this is an incomplete-fix notification for the prior CVE-2026-62292 advisory and that v1.23.1 should no longer be listed as patched until a complete fix is released (GitHub Advisory).