{"schema":"threatline.record/2","record":{"id":"CVE-2026-84383","aliases":["GHSA-g89c-p67h-r497"],"summary":"libheif: Heap buffer overflow in `scale_nearest_neighbor()` via duplicate Alpha planes from nested `iden`/`auxl` items","details":"libheif is a HEIF and AVIF file format decoder and encoder. From 1.22.0 until 1.23.2, a crafted HEIF, HEIC, or AVIF item graph using nested iden and auxl references can make HeifPixelImage::transfer_channel_from_image_as() append duplicate Alpha planes with different bit depths to m_storage. HeifPixelImage::scale_nearest_neighbor() in libheif/image/pixelimage.cc allocates the destination Alpha plane using the first plane's 8-bit depth, then iterates a later 10-bit or 12-bit Alpha component and writes uint16_t samples into the same 8-bit allocation. The output geometry controls the overflow extent and the encoded sample values control the data written, allowing a remote file processed by heif_decode_image() to cause a heap out-of-bounds write. This issue is fixed in version 1.23.2.","categories":["Unclassified"],"product":"libheif","vendor":"strukturag","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-84383","source_modified_at":"2026-09-18T16:11:18.781Z","fetched_at":"2026-10-28T20:58:01.013507Z","product":"libheif","vendor":"strukturag","versions":[{"version":">= 1.22.0, < 1.23.2","status":"affected"}],"defaultStatus":null}],"fixed_versions":[],"cvss":9.8,"severity":"Critical","kev":{"listed":false},"epss":{"probability":0.00717,"percentile":0.53685,"score_date":"2026-10-28"},"published_at":"2026-09-18T15:55:46.914Z","modified_at":"2026-09-18T16:11:18.781Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-84383","fetched_at":"2026-10-28T20:58:01.013507Z","source_modified_at":"2026-09-18T16:11:18.781Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-84383","fetched_at":"2026-10-28T20:58:01.013507Z","source_modified_at":"2026-10-28"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/strukturag/libheif/security/advisories/GHSA-g89c-p67h-r497","tags":["exploit"]},{"source":"CVE List","url":"https://github.com/strukturag/libheif/commit/f4fb8bde4704ebb46e46ff9fb94407c9774153b2","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/strukturag/libheif/releases/tag/v1.23.2","tags":["x_refsource_MISC"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"poc","automatable":"yes","technical_impact":"total","assessed_at":"2026-09-18T16:07:46.621200Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-09-18T16:11:18.781Z","content_hash":"58dcba90edabf8982db1a0633d3deef6d5744e5daa9ff6ddf34d4562e0be62ab"}}