CVE-2026-84383

libheif is a HEIF and AVIF file format decoder and encoder. From 1.22.0 until 1.23.2, a crafted HEIF, HEIC, or AVIF item graph using nested iden and auxl references can make HeifPixelImage::transfer_channel_from_image_as() append duplicate Alpha planes with different bit depths to m_storage. HeifPixelImage::scale_nearest_neighbor() in libheif/image/pixelimage.cc allocates the destination Alpha plane using the first plane's 8-bit depth, then iterates a later 10-bit or 12-bit Alpha component and writes uint16_t samples into the same 8-bit allocation. The output geometry controls the overflow extent and the encoded sample values control the data written, allowing a remote file processed by heif_decode_image() to cause a heap out-of-bounds write. This issue is fixed in version 1.23.2.

• CWE-787

• https://github.com/strukturag/libheif/commit/f4fb8bde4704ebb46e46ff9fb94407c9774153b2
• https://github.com/strukturag/libheif/releases/tag/v1.23.2
• https://github.com/strukturag/libheif/security/advisories/GHSA-g89c-p67h-r497
• https://github.com/strukturag/libheif/security/advisories/GHSA-g89c-p67h-r497

Published

Sep 18, 2026

Last Modified

Sep 18, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-84378HTTPX2 is a next generation HTTP client for Python. From 2.5…5.9
• CVE-2026-84379HTTPX2 is a next generation HTTP client for Python. Prior to…5.3
• CVE-2026-8438The All-In-One Security (AIOS) – Security and Firewall plugi…7.2
• CVE-2026-84380HTTPX2 is a next generation HTTP client for Python. Prior to…5.6
• CVE-2026-84381HTTPX2 is a next generation HTTP client for Python. Prior to…8.1
• CVE-2026-84382HTTPX2 is a next generation HTTP client for Python. Prior to…7.5
• CVE-2026-84384libheif is a HEIF and AVIF file format decoder and encoder. …7.5
• CVE-2026-84385A improper access control vulnerability in Fortinet FortiSOA…5.4
• CVE-2026-84386A unverified ownership vulnerability in Fortinet FortiClient…5.1
• CVE-2026-84387A improper neutralization of special elements used in a comm…7.2
• CVE-2026-84389A url redirection to untrusted site ('open redirect') vulner…3.1
• CVE-2026-84390A inclusion of sensitive information in source code vulnerab…9.8