Bug 2538235 (CVE-2026-84448)

Summary: CVE-2026-84448 libheif: libheif: Information disclosure and denial of service due to heap out-of-bounds read
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in libheif, a library for decoding and encoding HEIF and AVIF image files. An application that uses the libheif writer API to construct region metadata may be vulnerable to a heap out-of-bounds read. This occurs because the `heif_region_item_add_region_inline_mask_data()` function accepts mask data without proper size verification. A subsequent read operation can access memory beyond the allocated buffer, potentially leading to the disclosure of sensitive heap data or causing the application to crash, resulting in a denial of service.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2539265, 2539266    
Bug Blocks:    

Description OSIDB Bzimport 2026-09-22 17:28:19 UTC 
libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, the public heif_region_item_add_region_inline_mask_data() function in libheif/api/libheif/heif_regions.cc accepts mask_data_len without verifying that it equals the byte count required by width and height. A later heif_region_get_mask_image() call derives the read length from the region geometry, so an undersized stored buffer causes heif_region_get_inline_mask_image() to read beyond the heap allocation and copy adjacent bytes into the returned monochrome mask image. This can disclose heap data or crash an application that constructs region metadata through the writer API, while the file-parsing path is not affected because it validates the canonical mask size. This issue is fixed in version 1.23.2.