Is CVE-2026-84446 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-84446 being exploited in the wild.

How severe is CVE-2026-84446?

High severity, with a CVSS score of 7.5, published 18 September 2026.

Which products and versions are affected?

Strukturag Libheif before 1.23.2.

Is there a fix for CVE-2026-84446?

A patch was published on 2026-08-25: Fixed in libheif 1.23.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-84446 attacked?

It is attacked over the network or from the adjacent network, in a software library.

Am I affected by CVE-2026-84446?

Check whether you run Strukturag Libheif at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-84446: libheif sequence timing denial of service and memory exhaustion

CVE-2026-84446 · Severity: high · CVSS 7.5 · Published 2026-09-18

libheif is a library for decoding and encoding HEIF and AVIF image files. Crafted HEIF files with malicious sequence timing and edit-list data can cause the decoder to enter non-terminating loops and allocate unbounded memory, allowing an attacker to exhaust CPU and memory resources from a small file. This vulnerability can be triggered by simply opening a malicious file in any application using the affected library.

Technologies: Strukturag Libheif. Vendors: Strukturag.

Quick answers

Is CVE-2026-84446 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-84446 being exploited in the wild.
How severe is CVE-2026-84446?: High severity, with a CVSS score of 7.5, published 18 September 2026.
Which products and versions are affected?: Strukturag Libheif before 1.23.2.
Is there a fix for CVE-2026-84446?: A patch was published on 2026-08-25: Fixed in libheif 1.23.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-84446 attacked?: It is attacked over the network or from the adjacent network, in a software library.
Am I affected by CVE-2026-84446?: Check whether you run Strukturag Libheif at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in Track::init_sample_timing_table(), which computes a logical m_num_output_samples value as a uint64 that can exceed uint32_t limits, but decode/raw-output loops use uint32 counters that can never reach the oversized count, causing non-terminating loops. Additionally, Box_stts::get_sample_duration() performs O(entries×samples) scans, and Chunk::m_sample_ranges and Track::m_presentation_timeline are allocated outside MemoryHandle accounting, allowing severe CPU and memory exhaustion. The attack vector is network/adjacent via opening a malicious HEIF/AVIF file; no authentication or user interaction beyond file opening is required.

Affected products

strukturag libheif before 1.23.2

Timeline

2026-09-18: disclosed: CVE-2026-84446 published
2026-08-25: patched: Fixed in libheif 1.23.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.