USN-8846-1: libheif vulnerabilities · ZeroHour

Ubuntu Security Noticespublished Sep 29, 16:18 UTC (1d ago)ingested Sep 29, 20:36 UTC

USN-8846-1: libheif vulnerabilities

lowAdvisoryimportance 15CVE-2026-84384 CVE-2026-84446

AI summary · glm-5.3

Ubuntu USN-8846-1 patches libheif flaws allowing remote denial of service via crafted metadata and HEIF data.

Ubuntu Security Notice USN-8846-1 fixes multiple libheif vulnerabilities discovered by Yuqi Qiu and Xiang Li. CVE-2026-84384 involves incorrect handling of compressed metadata and affects Ubuntu 24.04 LTS and 26.04 LTS; CVE-2026-84446 involves incorrect HEIF sequence data handling and affects Ubuntu 26.04 LTS. A further flaw in image reference handling also enables remote denial of service. All issues could allow a remote attacker to crash applications processing malicious HEIF files.

CVE-2026-84384: compressed metadata DoS, affects Ubuntu 24.04 LTS and 26.04 LTS
CVE-2026-84446: HEIF sequence data DoS, affects Ubuntu 26.04 LTS
Remote denial of service only; no code execution indicated

Read the original

OrganizationsCanonical Ubuntu libheif

Tags#ubuntu #libheif #usn #denial-of-service #heif #patch

Vulnerabilities mentionedAll →

CVE-2026-843847.5—
Unbounded decompression memory DoS in libheif HEIF/AVIF decoder 1.19.0-1.23.1
published 12d ago· struktur AG (libheif project) libheif
CVE-2026-844467.5—
Infinite-loop DoS in libheif HEIF/AVIF decoder before 1.23.2
published 12d ago· strukturag libheif

CVE	Vulnerability	CVSS	EPSS	Flags	Affected

Full article

Yuqi Qiu and Xiang Li discovered that libheif incorrectly handled certain compressed metadata. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-84384) Yuqi Qiu and Xiang Li discovered that libheif incorrectly handled certain HEIF sequence data. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-84446) Yuqi Qiu and Xiang Li discovered that libheif incorrectly handled certain image references. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 26.04…

This source does not provide full text. Read it at ubuntu.com.

Unbounded decompression memory DoS in libheif HEIF/AVIF decoder 1.19.0-1.23.1

libheif versions 1.19.0 through before 1.23.2 fail to limit accumulated decompressed output when parsing crafted HEIF or AVIF files: the brotli path (decompress_brotli()) applies no output bound at all, the zlib path (do_inflate()) checks only a small temporary buffer in a branch that valid streams never reach, and neither path performs MemoryHandle accounting. Overlapping icef units can force the same compressed payload to be decompressed repeatedly, and HeifContext::interpret_heif_file_images() processes multiple compressed mime-metadata items while opening the file, so a very small malicious file can drive memory consumption without limit and terminate the process. An attacker who can submit a crafted HEIF or AVIF file to any application or service built on an affected libheif (image upload processors, thumbnailers, conversion pipelines, desktop viewers) gains a remote denial-of-service with no confidentiality or integrity impact (CVSS 7.5, availability only). Anyone packaging or embedding libheif 1.19.0 to before 1.23.2 and decoding untrusted files is affected; the flaw is fixed in version 1.23.2. No public proof-of-concept is known and the issue is not listed in CISA KEV, so no exploitation has been reported.

Do: Upgrade libheif to 1.23.2 (or apply a distribution backport) anywhere the library decodes untrusted files, and check bundled consumers such as ImageMagick, libvips-based stacks and thumbnail services for the 1.19.0-1.23.1 range. Until patched, restrict or reject user-supplied HEIF/AVIF uploads and run decoding in sandboxed worker processes with hard memory limits (cgroup or rlimit caps) so an OOM kill cannot take down the host service.

7.5

—

struktur AG (libheif project) libheif >= 1.19.0, < 1.23.2 (fixed in 1.23.2)

massmillions of deployments plausibly embed a vulnerable libheif via Linux distro packages and bundled image libraries (rough order-of-magnitude estimate)

12d ago

Infinite-loop DoS in libheif HEIF/AVIF decoder before 1.23.2

libheif, a widely used open-source HEIF and AVIF decoder/encoder library, contains a logic flaw (CWE-835) in which crafted HEIF sequence timing and edit-list data cause Track::init_sample_timing_table() to compute an m_num_output_samples value that exceeds the uint32_t counters used in Track_Visual::decode_next_image_sample() and Track::get_next_sample_raw_data(). Because the loop condition can never reach the oversized output count, decoding or raw-sample extraction enters a non-terminating loop, bypasses the max_sequence_frames safeguard, and repeatedly calls Box_stts::get_sample_duration() while allocating Chunk::m_sample_ranges and Track::m_presentation_timeline outside MemoryHandle accounting. An attacker who can supply a small malicious HEIF file to a system using a vulnerable libheif can therefore inflict severe CPU and memory exhaustion, i.e., a denial of service, with no confidentiality or integrity impact. Any deployment that decodes untrusted HEIF/AVIF files with libheif prior to 1.23.2 is affected, including image-upload and thumbnailing services, desktop and mobile applications, and anything embedding the library via distributions or image-processing stacks. No public proof-of-concept is known, the issue is not in CISA's KEV, and no in-the-wild exploitation has been reported.

Do: Upgrade libheif to version 1.23.2 or later, including rebuilds shipped by your Linux distribution or application vendor. Until patched, restrict or validate untrusted HEIF/AVIF uploads, and apply decode timeouts and CPU/memory limits to image-processing workers. Check installed library versions and dependencies (e.g., via your package manager or SBOM) to confirm whether libheif is present and from which application it is reachable.

7.5

—

strukturag libheif all versions prior to 1.23.2 (fixed in 1.23.2)