Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-84384

libheif: brotli/zlib decompression paths lack output-size limits, allowing decompression-bomb OOM/DoS

CVSS 3.1 7.5 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-84384

Published

libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.2, crafted HEIF or AVIF mime metadata and unci image data can cause decompress_brotli() and do_inflate() to grow accumulated output without an effective size limit or MemoryHandle accounting. The brotli path has no output bound, while the zlib path checks only a small temporary buffer in a branch that valid streams do not reach, and overlapping icef units can decompress the same payload repeatedly. HeifContext::interpret_heif_file_images() processes multiple compressed metadata items during file opening, allowing a small file to consume unbounded memory and terminate the process. This issue is fixed in version 1.23.2.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-84384

Published

libheif

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "strukturag",
                    "product": "libheif",
                    "versions": [
                        {
                            "version": ">= 1.19.0, < 1.23.2",
                            "status": "affected"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON