# CVE-2026-84448: libheif heap out-of-bounds read in inline-mask region API

Source: https://junglewise.ai/threats/cve-2026-84448-libheif-is-a-heif-and-avif-file-format-decoder-and-encoder-prior  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-18. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-84448 · Severity: medium · CVSS 4 · Published 2026-09-18

libheif is a HEIF and AVIF image decoder and encoder library used by media applications and image processors. A flaw in the region mask writer API allows code that constructs region metadata to read beyond allocated heap memory, potentially disclosing sensitive data or crashing the application. File parsing is unaffected because it validates mask sizes correctly.

Technologies: [Strukturag Libheif](https://junglewise.ai/threats/technologies/strukturag-libheif). Vendors: [Strukturag](https://junglewise.ai/threats/vendors/strukturag).

## Quick answers

**Is CVE-2026-84448 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-84448 being exploited in the wild.

**How severe is CVE-2026-84448?** Medium severity, with a CVSS score of 4, published 18 September 2026.

**Which products and versions are affected?** Strukturag Libheif prior to 1.23.2.

**Is there a fix for CVE-2026-84448?** A patch was published on 2026-08-24: Fixed in version 1.23.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-84448 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-84448?** Check whether you run Strukturag Libheif at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The heif_region_item_add_region_inline_mask_data() function in the writer API accepts a caller-supplied mask_data_len parameter without validating it matches the expected size derived from region geometry (width*height+7)/8 bytes. Later, heif_region_get_inline_mask_image() reads from the undersized buffer using the geometry-derived length, causing an out-of-bounds heap read that copies adjacent memory into the returned mask image. Attack requires use of the writer API; file parsing validates mask sizes and is not affected.

## Affected products

- strukturag libheif prior to 1.23.2

## Timeline

- 2026-09-18: disclosed
- 2026-08-24: patched: Fixed in version 1.23.2

## References

- [https://github.com/strukturag/libheif/commit/646d85fbf5bd18fc3cdc516e915e59072de2d510](https://github.com/strukturag/libheif/commit/646d85fbf5bd18fc3cdc516e915e59072de2d510)
- [https://github.com/strukturag/libheif/releases/tag/v1.23.2](https://github.com/strukturag/libheif/releases/tag/v1.23.2)

## Related threats

- [libheif heap buffer overflow in unc_decoder_mixed_interleave](https://junglewise.ai/threats/cve-2026-120208-libheif-1-18-0-before-1-23-3-contains-a-heap-based-buffer)
- [libheif integer overflow in uncompressed tile range check](https://junglewise.ai/threats/cve-2026-84451-libheif-is-a-heif-and-avif-file-format-decoder-and-encoder-from-1)
- [libheif assertion failure in clap property crop calculation](https://junglewise.ai/threats/cve-2026-84450-libheif-is-a-heif-and-avif-file-format-decoder-and-encoder-from-1)
- [libheif reference amplification denial of service](https://junglewise.ai/threats/cve-2026-84447-libheif-is-a-heif-and-avif-file-format-decoder-and-encoder-in-1)
- [libheif sequence timing denial of service and memory exhaustion](https://junglewise.ai/threats/cve-2026-84446-libheif-is-a-heif-and-avif-file-format-decoder-and-encoder-prior)