Quick answers
- Is CVE-2026-84451 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-84451 being exploited in the wild.
- How severe is CVE-2026-84451?
- Medium severity, with a CVSS score of 6.5, published 18 September 2026.
- Which products and versions are affected?
- Strukturag Libheif 1.19.0 through 1.23.2.
- Is there a fix for CVE-2026-84451?
- A patch was published on 2026-09-01: Fixed in version 1.23.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-84451 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-84451?
- Check whether you run Strukturag Libheif at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An integer overflow in unc_decoder::get_compressed_image_data_uncompressed() allows range_start_offset + range_size to wrap in uint64_t arithmetic when processing a crafted uncompressed tile grid, bypassing bounds checking. This permits heif_image_handle_decode_image_tile() to call memcpy() with an invalid source pointer and excessive length, causing an out-of-bounds read. The vulnerability is triggered only in the no-icef full-item code path when decoding individual tiles via heif_image_handle_decode_image_tile().
Affected products
- strukturag libheif 1.19.0 through 1.23.2
Timeline
- 2026-09-18: disclosed
- 2026-09-01: patched: Fixed in version 1.23.3