Skip to main content

libheif CVE-2026-84451

MEDIUM
2026-09-04 vendor:ubuntu
Buffer Overflow Suse
Share

Severity by source

vuln.today AI
5.4 MEDIUM

Network-reachable via crafted file, no privileges needed, user interaction required to open/process the image, OOB read yields limited confidentiality and crash risk.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Estimated by vuln.today — no official severity rating has been published for this CVE yet.

Lifecycle Timeline

1
Analysis Generated
Sep 04, 2026 - 18:39 vuln.today

DescriptionCVE.org

[Incomplete fix for GHSA-73p7-m7gg-w2jv leaves libheif 1.23.1 vulnerable to an out-of-bounds read]

AnalysisAI

Out-of-bounds read in libheif 1.23.1 persists because the upstream patch for GHSA-73p7-m7gg-w2jv was incomplete, leaving the library still vulnerable in its latest release at time of disclosure. Any application or pipeline that uses libheif to parse HEIF/HEIC image files - including desktop viewers, photo management tools, and server-side media processors - is exposed when handling untrusted image input. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires that the target application links against libheif 1.23.1 (or an equivalently patched build) and processes a crafted HEIF/HEIC image provided by the attacker. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment No CVSS vector or score is provided in the input data, so quantitative risk signals are limited. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Upgrade libheif to a version released after 1.23.1 that contains a complete fix for the out-of-bounds read; the exact corrected upstream release version is not confirmed in the available data and should be verified against the libheif GitHub repository (https://github.com/strukturag/libheif) and the associated GHSA-73p7-m7gg-w2jv advisory. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected

Share

CVE-2026-84451 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy