External risk intelligence

libheif Heap Out-of-Bounds Write Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-84383

libheif is a library for processing image files. While it is frequently used in applications that may handle user-supplied files from the internet, it is a backend component rather than a standalone internet-facing service. Exposure depends entirely on the host application's implementation and whether it automatically processes untrusted files from public sources.

Out-of-bounds Write

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in the libheif library could allow an attacker to remotely cause a critical system failure by providing a specially crafted image file. This issue impacts systems that use libheif to decode image formats like HEIF, HEIC, or AVIF, potentially leading to unauthorized access or data compromise. The main concern is confirming relevance and exposure.

Malicious image files can cause system failures.
Critical library vulnerability affects image processing.
Confirm relevance and exposure for affected systems.

Attack Path

How an attacker could exploit the issue

An attacker could trigger this vulnerability by providing a specially crafted image file to an application that uses libheif for decoding. The crafted file, when processed by the `heif_decode_image()` function, can lead to an out-of-bounds write in the heap memory. This type of vulnerability can potentially allow an attacker to compromise the integrity and availability of the affected system.

Entry condition: Attacker supplies a crafted image file.
Trigger point: Image decoding process.
Resulting risk: Heap out-of-bounds write.

Live Threat

Current exploitation, exposure, and threat context

A specially crafted image file processed by `heif_decode_image()` could lead to a heap out-of-bounds write, potentially affecting the integrity and availability of systems handling these image formats. This vulnerability may occur when the library processes image files with nested references that cause duplicate Alpha planes with differing bit depths to be appended to the storage, leading to memory corruption.

System memory and file integrity.
Processing a crafted image file.
Crash or unpredictable behavior.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in libheif, an image processing library, could allow remote attackers to cause a heap out-of-bounds write when processing crafted HEIF, HEIC, or AVIF files. Ownership of this issue will likely fall to application teams integrating libheif, platform teams managing shared libraries, or infrastructure teams responsible for the underlying systems. The first practical step is to identify all systems and applications utilizing libheif, assess their exposure to external file processing, and confirm the accountable owner for remediation.

Application owners should own the issue.
Verify libheif usage and exposure.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is libheif?

libheif is a software library used by applications to encode and decode modern image formats, specifically HEIF, HEIC, and AVIF. It is widely integrated into operating systems, media viewers, and web browsers to handle these high-efficiency file types. Because it functions as a backend component, many users interact with it indirectly whenever their software opens or displays these specific image files.

What is the nature of the CVE-2026-84383 vulnerability?

This vulnerability is a heap out-of-bounds write, classified as CWE-787. It occurs when the library mismanages memory while processing complex image data. Specifically, it confuses different bit depths when handling Alpha planes in a file, causing the program to write data into an area of memory that it does not own. This memory corruption can lead to unpredictable system behavior, crashes, or potential security compromises.

How is this vulnerability triggered?

An attacker triggers this issue by providing a specially crafted HEIF, HEIC, or AVIF image file to an application that uses the vulnerable libheif decoding function. The vulnerability is specifically activated when the image file contains complex, nested references that force the library to allocate insufficient memory. Simply having the library installed is not enough; the software must actively process a malicious file to trigger the memory error.

Is my system at risk?

Risk depends on how your software uses libheif, according to Halo Surface Signal. If your applications automatically decode untrusted image files from public sources or the internet, they are at higher risk. If the software only processes images from trusted, local sources, the likelihood of exploitation is significantly lower. You should evaluate whether your applications bridge the gap between untrusted external files and the library's decoding process.

What should I do to address this issue?

The first step is to create an inventory of all applications and services within your environment that use the libheif library. Once identified, prioritize updating these components to version 1.23.2 or later, which contains the fix for this memory handling error. Coordinate with your application development or platform teams to ensure the updated library version is correctly integrated and deployed.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.