Is CVE-2026-84448 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-84448 being exploited in the wild.

How severe is CVE-2026-84448?

Medium severity, with a CVSS score of 4, published 18 September 2026.

Which products and versions are affected?

Strukturag Libheif prior to 1.23.2.

Is there a fix for CVE-2026-84448?

A patch was published on 2026-08-24: Fixed in version 1.23.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-84448 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-84448?

Check whether you run Strukturag Libheif at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-84448: libheif heap out-of-bounds read in inline-mask region API

CVE-2026-84448 · Severity: medium · CVSS 4 · Published 2026-09-18

libheif is a HEIF and AVIF image decoder and encoder library used by media applications and image processors. A flaw in the region mask writer API allows code that constructs region metadata to read beyond allocated heap memory, potentially disclosing sensitive data or crashing the application. File parsing is unaffected because it validates mask sizes correctly.

Technologies: Strukturag Libheif. Vendors: Strukturag.

Quick answers

Is CVE-2026-84448 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-84448 being exploited in the wild.
How severe is CVE-2026-84448?: Medium severity, with a CVSS score of 4, published 18 September 2026.
Which products and versions are affected?: Strukturag Libheif prior to 1.23.2.
Is there a fix for CVE-2026-84448?: A patch was published on 2026-08-24: Fixed in version 1.23.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-84448 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-84448?: Check whether you run Strukturag Libheif at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The heif_region_item_add_region_inline_mask_data() function in the writer API accepts a caller-supplied mask_data_len parameter without validating it matches the expected size derived from region geometry (width*height+7)/8 bytes. Later, heif_region_get_inline_mask_image() reads from the undersized buffer using the geometry-derived length, causing an out-of-bounds heap read that copies adjacent memory into the returned mask image. Attack requires use of the writer API; file parsing validates mask sizes and is not affected.

Affected products

strukturag libheif prior to 1.23.2

Timeline

2026-09-18: disclosed
2026-08-24: patched: Fixed in version 1.23.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.