libheif CVE-2026-84450

The vulnerability requires that the target application use libheif version 1.23.1 specifically to parse a specially crafted HEIF or HEIC image file. The malformed input must exercise the variant of the out-of-bounds read that was not addressed by the incomplete patch - other variants may have been closed. User interaction or an automated pipeline action (opening or processing the image) is required; passive network presence is insufficient. Exploitation is constrained to the out-of-bounds read class, meaning direct code execution depends on heap layout and the presence of exploitable memory adjacent to the over-read region. Applications that restrict HEIF/HEIC ingestion to trusted, integrity-validated sources are not practically exposed.

No CVSS vector or score is provided for this CVE, preventing precise metric-based scoring. The vulnerability class - out-of-bounds read in a media parsing library - typically yields information disclosure (heap memory leakage) and crash-based denial of service; escalation to full code execution is possible but depends on heap layout and requires additional exploitation primitives. The 'incomplete fix' framing is the most important signal here: it means deployments that upgraded to 1.23.1 from a vulnerable version may believe they are protected when they are not, a false assurance that can delay re-patching. EPSS and CISA KEV data are absent, and no public exploit or proof-of-concept code has been identified at time of analysis. Real-world risk is proportional to how much untrusted HEIF content a deployment processes - even a mid-sized municipal IT team in mielec running image-processing pipelines that ingest user-uploaded photos would face meaningful exposure until a complete upstream fix is confirmed and deployed.

An attacker crafts a malicious HEIF or HEIC image file that exercises the code path left unaddressed by the incomplete GHSA-73p7-m7gg-w2jv fix in libheif 1.23.1, then delivers it to a target via a web upload, email attachment, or shared storage location. When the victim application - an image viewer, thumbnail service, or media transcoder - processes the file, the out-of-bounds read is triggered, leaking heap memory that may contain sensitive in-process data or crashing the application. No public proof-of-concept code has been identified at time of analysis.