Is CVE-2026-84383 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-84383 being exploited in the wild.

How severe is CVE-2026-84383?

Critical severity, with a CVSS score of 9.8, published 18 September 2026.

Which products and versions are affected?

Strukturag Libheif 1.22.0 to 1.23.1.

Is there a fix for CVE-2026-84383?

A patch was published on 2026-08-23: Fixed in version 1.23.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-84383 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-84383?

Check whether you run Strukturag Libheif at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-84383: libheif heap overflow in scale_nearest_neighbor via duplicate alpha planes

CVE-2026-84383 · Severity: critical · CVSS 9.8 · Published 2026-09-18

libheif is a decoder and encoder for HEIF, HEIC, and AVIF image formats commonly used in modern devices and applications. A malicious image file can exploit the way libheif handles alpha transparency layers, causing it to write data beyond allocated memory boundaries. An attacker who tricks a user into opening a crafted image file can crash the application or potentially execute arbitrary code on the victim's system.

Technologies: Strukturag Libheif. Vendors: Strukturag.

Quick answers

Is CVE-2026-84383 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-84383 being exploited in the wild.
How severe is CVE-2026-84383?: Critical severity, with a CVSS score of 9.8, published 18 September 2026.
Which products and versions are affected?: Strukturag Libheif 1.22.0 to 1.23.1.
Is there a fix for CVE-2026-84383?: A patch was published on 2026-08-23: Fixed in version 1.23.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-84383 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-84383?: Check whether you run Strukturag Libheif at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in HeifPixelImage::scale_nearest_neighbor() which allocates an 8-bit alpha plane buffer but then writes 10-bit or 12-bit sample values into it when processing nested iden and auxl item references that create duplicate alpha planes with mismatched bit depths. The heap out-of-bounds write is triggered during image decode and is controlled by the image geometry and encoded sample values. This issue is fixed by validating and rejecting duplicate or mismatched-size alpha planes during image decoding.

Affected products

strukturag libheif 1.22.0 to 1.23.1

Timeline

2026-09-18: disclosed: Published on NVD
2026-08-23: patched: Fixed in version 1.23.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.