CVE-2026-84448

libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, the public heif_region_item_add_region_inline_mask_data() function in libheif/api/libheif/heif_regions.cc accepts mask_data_len without verifying that it equals the byte count required by width and height. A later heif_region_get_mask_image() call derives the read length from the region geometry, so an undersized stored buffer causes heif_region_get_inline_mask_image() to read beyond the heap allocation and copy adjacent bytes into the returned monochrome mask image. This can disclose heap data or crash an application that constructs region metadata through the writer API, while the file-parsing path is not affected because it validates the canonical mask size. This issue is fixed in version 1.23.2.

• CWE-125
• CWE-131

• https://github.com/strukturag/libheif/commit/646d85fbf5bd18fc3cdc516e915e59072de2d510
• https://github.com/strukturag/libheif/releases/tag/v1.23.2
• https://github.com/strukturag/libheif/security/advisories/GHSA-p58j-h3vm-3fp5

Published

Sep 18, 2026

Last Modified

Sep 18, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-84441A security vulnerability has been detected in Piwigo up to 1…7.3
• CVE-2026-84442A vulnerability was identified in MapQuest Get Directions Ap…4.4
• CVE-2026-84444libheif is a HEIF and AVIF file format decoder and encoder. …7.4
• CVE-2026-84445gRPC-Go is the Go language implementation of gRPC. Prior to …8.7
• CVE-2026-84446libheif is a HEIF and AVIF file format decoder and encoder. …7.5
• CVE-2026-84447libheif is a HEIF and AVIF file format decoder and encoder. …7.5
• CVE-2026-84449libheif is a HEIF and AVIF file format decoder and encoder. …3.7
• CVE-2026-8445justhtml versions <= 1.11.0 (fixed in 1.12.0) do not suffici…9.8
• CVE-2026-84450libheif is a HEIF and AVIF file format decoder and encoder. …4.3
• CVE-2026-84451libheif is a HEIF and AVIF file format decoder and encoder. …6.5
• CVE-2026-84452Windows ML CLI is a command line tool for building portable,…8.6
• CVE-2026-8446IBM Langflow OSS 1.0.0 through 1.10.3 contain an authenticat…7.5