CVE-2026-84384

libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.2, crafted HEIF or AVIF mime metadata and unci image data can cause decompress_brotli() and do_inflate() to grow accumulated output without an effective size limit or MemoryHandle accounting. The brotli path has no output bound, while the zlib path checks only a small temporary buffer in a branch that valid streams do not reach, and overlapping icef units can decompress the same payload repeatedly. HeifContext::interpret_heif_file_images() processes multiple compressed metadata items during file opening, allowing a small file to consume unbounded memory and terminate the process. This issue is fixed in version 1.23.2.

• CWE-409

• https://github.com/strukturag/libheif/commit/21893e8f66c8b79363ca2809391b07d35e1a95ec
• https://github.com/strukturag/libheif/releases/tag/v1.23.2
• https://github.com/strukturag/libheif/security/advisories/GHSA-24wx-9w62-c96w
• https://github.com/strukturag/libheif/security/advisories/GHSA-24wx-9w62-c96w

Published

Sep 18, 2026

Last Modified

Sep 18, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-84379HTTPX2 is a next generation HTTP client for Python. Prior to…5.3
• CVE-2026-8438The All-In-One Security (AIOS) – Security and Firewall plugi…7.2
• CVE-2026-84380HTTPX2 is a next generation HTTP client for Python. Prior to…5.6
• CVE-2026-84381HTTPX2 is a next generation HTTP client for Python. Prior to…8.1
• CVE-2026-84382HTTPX2 is a next generation HTTP client for Python. Prior to…7.5
• CVE-2026-84383libheif is a HEIF and AVIF file format decoder and encoder. …9.8
• CVE-2026-84385A improper access control vulnerability in Fortinet FortiSOA…5.4
• CVE-2026-84386A unverified ownership vulnerability in Fortinet FortiClient…5.1
• CVE-2026-84387A improper neutralization of special elements used in a comm…7.2
• CVE-2026-84389A url redirection to untrusted site ('open redirect') vulner…3.1
• CVE-2026-84390A inclusion of sensitive information in source code vulnerab…9.8
• CVE-2026-84391A use of uninitialized variable vulnerability in Fortinet Fo…6.5