libheif CVE-2026-84448

Exploitation requires an application that constructs region metadata through libheif's WRITER API and calls heif_region_item_add_region_inline_mask_data() with a mask_data_len that does not equal (width*height+7)/8, followed by a heif_region_get_mask_image() render. The file-parsing/decode path is explicitly NOT vulnerable because it validates the canonical mask size, so simply opening a malicious HEIF/AVIF file does not trigger it. Realistic risk is therefore limited to programs that let attacker-influenced geometry and mask buffers disagree while building inline-mask regions; affected versions are libheif prior to 1.23.2, and the vector is local (AV:L) with high attack complexity (AC:H).

This is a genuine but low-priority memory-safety issue, not a high-CVSS emergency. The vendor CVSS 3.1 base score is 4.0 (AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L), and the signals are internally consistent with a narrow, hard-to-reach bug: local vector, high attack complexity, limited confidentiality impact (partial heap disclosure) and low availability impact (crash). No EPSS score, no CISA KEV listing, and no public exploit are present in the intelligence - the only 'PoC' is a vendor regression test in tests/region.cc that demonstrates the OOB read, which is not a weaponized exploit. The single most important limiting factor, confirmed by both the description and the commit diff, is that ONLY the writer/encoder path is vulnerable: heif_region_item_add_region_inline_mask_data() trusts caller-supplied mask_data_len, whereas the file-PARSING path (RegionGeometry_InlineMask::parse) already validates the canonical mask size and is explicitly NOT affected. That inverts the usual libheif threat model - a malicious HEIF/AVIF file does NOT trigger this; instead an application must itself call the region-writer API with attacker-influenced geometry and an undersized mask buffer. There is no conflict between the CVSS vector and the description; both point to a local, application-integration-dependent issue rather than remote drive-by exploitation.

An application uses libheif's writer API to attach inline-mask region metadata, deriving mask geometry (width/height) and the mask buffer from separate, partly attacker-controlled inputs. The attacker supplies a mask_data_len smaller than ceil(width*height/8), so a later heif_region_get_mask_image() call reads past the undersized heap allocation and copies adjacent heap bytes into the returned monochrome mask, disclosing heap contents or crashing the process. No public weaponized exploit exists; only a vendor regression test demonstrates the out-of-bounds read, and the CVSS AV:L/AC:H rating reflects that this requires a specific writer-API integration rather than remote file parsing.