Skip to main content

libavif CVE-2026-84383

MEDIUM
2026-09-04 vendor:ubuntu
Buffer Overflow Suse
Share

Severity by source

vuln.today AI
8.8 HIGH

Network-delivered crafted image, no privileges needed, user or pipeline must process it; heap overflow enables full memory corruption.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
8.1 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Lifecycle Timeline

1
Analysis Generated
Sep 04, 2026 - 19:10 vuln.today

DescriptionCVE.org

[GHSA-g89c-p67h-r497: Heap buffer overflow in scale_nearest_neighbor() via duplicate Alpha planes from nested iden/auxl items]

AnalysisAI

Heap buffer overflow in libavif's scale_nearest_neighbor() function can be triggered by a crafted AVIF image containing nested iden/auxl items that introduce duplicate Alpha planes. An attacker who delivers a malicious AVIF file to an application or service that decodes it - browsers, image editors, server-side media pipelines - can cause heap memory corruption, leading to denial of service or potentially arbitrary code execution. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Persist
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The target application must decode AVIF images using a vulnerable version of libavif. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment No CVSS vector, EPSS score, KEV listing, or POC is available in the provided data, so risk must be inferred from the vulnerability class and attack surface. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Consult the upstream GitHub Security Advisory GHSA-g89c-p67h-r497 for the patched libavif release version, as no exact fix version is available in the current data. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected

Share

CVE-2026-84383 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy