Read the docs
TI-2026-58038 Aliases CVE-2026-84448

Out-of-bounds read in strukturag libheif

Priority MEDIUM 52CWE-125Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
Low · None · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, the public heif_region_item_add_region_inline_mask_data() function in libheif/api/libheif/heif_regions.cc accepts mask_data_len without verifying that it equals the byte count required by width and height. A later heif_region_get_mask_image() call derives the read length from the region geometry, so an undersized stored buffer causes heif_region_get_inline_mask_image() to read beyond the heap allocation and copy adjacent bytes into the returned monochrome mask image. This can disclose heap data or crash an application that constructs region metadata through the writer API, while the file-parsing path is not affected because it validates the canonical mask size. This issue is fixed in version 1.23.2.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00186 8th percentileScored 2026-11-07
Fix Fixed libheif (strukturag): 1.23.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
strukturaglibheifbefore 1.23.21.23.2Patch availableCNA
  • libheif Vendorstrukturag Affected before 1.23.2 Fixed in 1.23.2 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:struktur:libheif:*:*:*:*:*:*:*:*——strukturag
  • cpe:2.3:a:struktur:libheif:*:*:*:*:*:*:*:* Versions — — ·strukturag

Remediation

  • Fix · CNA libheif (strukturag) Fixed in 1.23.2

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-84448

References

Other 3

  • TI-2026-57994 libheif: Heap buffer overflow in `scale_nearest_neighbor()` via duplicate Alpha planes from nested `iden`/`auxl` items CVSS 3.1CRITICAL 9.8
  • TI-2026-25594 NULL Pointer Dereference in libde265 CVSS 4.0HIGH 8.7
  • TI-2023-27026 Libde265 v1.0.14 was discovered to contain a global buffer overflow vulnerability in the… CVSS 3.1HIGH 8.8
  • TI-2023-27020 libheif v1.17.5 was discovered to contain a segmentation violation via the function… CVSS 3.1HIGH 8.8
  • TI-2026-58037 Resource allocation without limits in strukturag libheif CVSS 3.1HIGH 7.5
  • TI-2026-57995 libheif: brotli/zlib decompression paths lack output-size limits, allowing decompression-bomb OOM/DoS CVSS 3.1HIGH 7.5
See all 113 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences