libheif v1.23.2 Security Release: Fixes for Heap Overflow and Memory Exhaustion Vulnerabilities

libheif v1.23.2 Security Release Summary Vulnerability Overview This is a security and bug fix release that maintains ABI and API compatibility with v1.23.1, allowing for a direct drop-in replacement. It includes two fixes rated as critical; the vendor strongly recommends that all users upgrade. Affected Components The vulnerabilities primarily impact the image decoding/encoding paths in libheif, involving issues such as heap buffer overflows, out-of-bounds reads/writes, and memory exhaustion. The vulnerabilities were reported by David Schuz (Meta Product Security) and contributors @roothash, @KarimPwnz, @backtronal-research, @Nora-Qiu, @holimart, @buraks1998, and @zenniskayyy2K4. Security Fixes CVE-2026-84383 (GHSA-g89c-p67h-a82f): Heap buffer overflow in caused by nested alpha planes (critical). GHSA-2qg2-4zht-h549: Out-of-bounds read/write in derived items and pixel plane handling; after the fix, planes are not consumed when their size does not match the image geometry (critical). CVE-2026-84384 (GHSA-24vc-9w62-c96w): Brotli decompression did not enforce an output size limit, potentially leading to memory exhaustion (high). CVE-2026-84447 (GHSA-x8bm-cn2c-c1b9): A derived image reference chain bypasses the decode cache and memory limits, resulting in CPU and memory amplification (high). CVE-2026-84448 (GHSA-wv34-micp-5v7b): Sequence sampling timing initialization could trigger a non-terminating decode loop and unbounded memory usage (high). CVE-2026-84444 (GHSA-264-xwtp-5v7b): Out-of-bounds write in when a tile plane does not match the declared dimensions (high). CVE-2026-8448 (GHSA-p58h-h3vn-9h26): Heap out-of-bounds read in the inline mask region API when does not match the region geometry (medium). Hardening C++ exceptions no longer bypass the C API entry points for read/decode operations; instead, a is returned. Pixel plane allocation failures are now handled via a runtime error rather than . Concatenation tables are rejected if they describe more samples than exist in the track. Track sizes for the (JPEG 2000 palette) box are now calculated based on the box size. has been changed to a constant-time implementation (to avoid ambiguous timing side-channels). The uncompressed (unc) encoder now rejects images lacking pixel planes. Bug Fixes Correctly parse , , and boxes with a size of 0 (which extends to the end of the file). Fixed integer overflow when probing file sizes. Fixed undefined behavior (signed shift) when the OpenH264 decoder reads NAL unit lengths. Behavior Changes now requires non-zero width and height, and must equal ; otherwise, an error is returned instead of aborting. returns an error instead of aborting for bit depths outside the 1..128 range or interleaved component counts outside the 1..255 range. POC / Exploit Code The release notes do not include a POC or exploit code block.

Goal Reached Thanks to every supporter — we hit 100%!

libheif v1.23.2 Security Release: Fixes for Heap Overflow and Memory Exhaustion Vulnerabilities

More from this source