Skip to main content

libheif CVE-2026-84450

MEDIUM
2026-09-04 vendor:ubuntu
Buffer Overflow Suse
Share

Severity by source

vuln.today AI
5.4 MEDIUM

Malicious image delivered over network (AV:N), requires application to open file (UI:R), no privileges needed; OOB read yields partial memory disclosure and crash risk (C:L/I:N/A:L).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Estimated by vuln.today — no official severity rating has been published for this CVE yet.

Lifecycle Timeline

1
Analysis Generated
Sep 04, 2026 - 19:10 vuln.today

DescriptionCVE.org

[Incomplete fix for GHSA-73p7-m7gg-w2jv leaves libheif 1.23.1 vulnerable to an out-of-bounds read]

AnalysisAI

Out-of-bounds read in libheif 1.23.1 persists because the patch shipped for GHSA-73p7-m7gg-w2jv did not fully remediate the underlying flaw. Processing a specially crafted HEIF or HEIC image file can trigger a read beyond allocated buffer bounds, potentially leaking heap memory contents or crashing the parsing application. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Persist
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The vulnerability requires that the target application use libheif version 1.23.1 specifically to parse a specially crafted HEIF or HEIC image file. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment No CVSS vector or score is provided for this CVE, preventing precise metric-based scoring. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation No confirmed fully-patched version beyond 1.23.1 is specified in the available data, so a specific upgrade target cannot be stated. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected

Share

CVE-2026-84450 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy