CVE-2026-84449
- Source
- https://cve.org/CVERecord?id=CVE-2026-84449
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-84449.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2026-84449
- Aliases
-
- GHSA-2c3g-p585-8rpq
- Downstream
- Related
- Published
- 2026-09-18T16:03:28Z
- Modified
- 2026-09-30T18:27:17Z
- Severity
-
- 3.7 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
- Summary
- libheif hOp_RGB24_32_to_YCbCr Memory Access Error / SEGV
- Details
-
libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.19.6, Op_RGB24_32_to_YCbCr::convert_colorspace() stores image-plane strides in an integer width that can overflow for extremely large RGB images created through heif_image_create() and heif_image_add_plane(). The resulting wrapped stride causes the conversion loop in libheif/color-conversion/rgb2yuv.cc to compute an invalid input pointer and read beyond the allocated interleaved plane while heif_context_encode_image() performs RGB-to-YCbCr conversion. This can crash the encoding process. This issue is fixed in version 1.19.6.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-125", "CWE-190" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84449.json" }- References
-
- https://github.com/strukturag/libheif/releases/tag/v1.19.6
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84449.json
- https://github.com/strukturag/libheif/security/advisories/GHSA-2c3g-p585-8rpq
- https://nvd.nist.gov/vuln/detail/CVE-2026-84449
- https://github.com/strukturag/libheif/commit/e29953da30eb11aa1762df0bff3b36be4b22fbe3
Affected packages
Git / github.com/strukturag/libheif
Affected versions
v1.*
v1.1.0
v1.10.0
v1.11.0
v1.12.0
v1.13.0
v1.14.0
v1.14.1
v1.14.2
v1.15.0
v1.15.1
v1.15.2
v1.16.0
v1.16.1
v1.16.2
v1.17.0
v1.17.1
v1.17.2
v1.17.3
v1.17.4
v1.17.5
v1.17.6
v1.18.0
v1.18.0-rc1
v1.19.0
v1.19.1
v1.19.2
v1.19.3
v1.19.4
v1.19.5
v1.2.0
v1.3.0
v1.3.1
v1.3.2
v1.7.0
v1.8.0
v1.9.0
v1.9.1
Database specific
source
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-84449.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"line_hashes": [
"179328677177137954234807181024890845712",
"93534713415797560513386777094146548506",
"21183482683050143622360730610937334817",
"313657260711055404659488435757039008734",
"331994909722299205945920664753525222435",
"246580420481345094818193102253735445572",
"66832521798882037496612833724319800373",
"2362331427678903563216591128875157082",
"297702696074947045229079218293077761294",
"67519056256246979064598381107440148952",
"29091392131752372052130660839614196906",
"2443578288335845819316381250687301295",
"175244968109534058661105453159732178533",
"201207249599421137379118651860786976733",
"83308151607106994484315968396767224791",
"65178013787154873702426177758707662936",
"281927549270387561162096785913794376951",
"256598043387544909344970080415286821988",
"207243987260890374705019664016717227362",
"11206308316173162750637399463808358501",
"162729343568683709647965270346686355604",
"276144373869456888790887726892503765859",
"287650996955604403489383002779653820209",
"73415410408650101924480174679534195330",
"312748764050335460275548889956929675523",
"11206308316173162750637399463808358501",
"162729343568683709647965270346686355604",
"276144373869456888790887726892503765859"
],
"threshold": 0.9
},
"id": "CVE-2026-84449-277e2872",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/strukturag/libheif/commit/e29953da30eb11aa1762df0bff3b36be4b22fbe3",
"target": {
"file": "libheif/color-conversion/rgb2yuv.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"234494363333151829402393693856674331097",
"2862738862703939022201016593223122926",
"29581731580130140978632457232548562892",
"21079495303383478544610420766495826265",
"29991610885572445665308960357652417086",
"255986299423770698994153559912869109560",
"334909597946308594758815056722385404224",
"33152657341869196803808051922885952652"
],
"threshold": 0.9
},
"id": "CVE-2026-84449-34d884ea",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/strukturag/libheif/commit/e29953da30eb11aa1762df0bff3b36be4b22fbe3",
"target": {
"file": "libheif/image-items/mask_image.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"319764638794102433551642896101612645909",
"280778317919159476114224262596689742217",
"32303247694493427818317182467662893019",
"102772476972663660957999986050052173994",
"129931732860249110229852744804388885650",
"55779273007327414569926407554846270841",
"319764638794102433551642896101612645909",
"280778317919159476114224262596689742217",
"32303247694493427818317182467662893019",
"102772476972663660957999986050052173994",
"129931732860249110229852744804388885650",
"55779273007327414569926407554846270841",
"319764638794102433551642896101612645909",
"280778317919159476114224262596689742217",
"32303247694493427818317182467662893019",
"102772476972663660957999986050052173994",
"129931732860249110229852744804388885650",
"55779273007327414569926407554846270841",
"319764638794102433551642896101612645909",
"280778317919159476114224262596689742217",
"32303247694493427818317182467662893019",
"102772476972663660957999986050052173994",
"129931732860249110229852744804388885650",
"55779273007327414569926407554846270841"
],
"threshold": 0.9
},
"id": "CVE-2026-84449-3926e6bf",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/strukturag/libheif/commit/e29953da30eb11aa1762df0bff3b36be4b22fbe3",
"target": {
"file": "libheif/color-conversion/chroma_sampling.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"61216950609378154299658942288227315951",
"10410881776912379923720782706149761797",
"223743474504861833980033509208707949787",
"52415347561878277601352003521407586574",
"130508437175485232846264015538990075560",
"246498114212532577715262301639219353248",
"230559394299654918668378595241812458623",
"91338790179957514473242333196346055730",
"241996748628602950312114248648168302721",
"76755012389065774731513776093658215812",
"335948169066805918616432231235223787620"
],
"threshold": 0.9
},
"id": "CVE-2026-84449-3efe1bf7",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/strukturag/libheif/commit/e29953da30eb11aa1762df0bff3b36be4b22fbe3",
"target": {
"file": "libheif/pixelimage.h"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"162970813286118467602832741271203463832",
"329293940590192702920687412482776693091",
"283988350725997310606117207763303494831",
"167036811486252157562489051296999414445",
"233245139646846745215520939039224639233",
"23220903089427407522939116027502042044",
"162970813286118467602832741271203463832",
"329293940590192702920687412482776693091",
"283988350725997310606117207763303494831",
"252992051448854314797557571816825585401",
"122853963298324020725025857819643442785",
"242290582541269767794223324599346205878",
"161215053103717280392846071656955989496",
"147322289880562957688831277245737774976",
"233914073859692656207842201241854663306",
"292778596600160089640687343136380402608",
"325147446250604498329143424265012941585",
"35375246951941065493146795228645755765",
"62514555671312353444996302116305066636",
"272264439811797568577288743895722031662",
"220892746966489876443289863117518546796",
"189666005257298631127659581773904786287",
"56138240523283664761118601684837386762",
"140781652082839346730553144531922788607",
"100522323959736511160508644541559686589",
"221267105449175471214468631857178173830",
"285916605131832225000221950187294526860",
"109932417942191155730717561062091221666",
"163399792199904647502017177865421009974",
"50185434106855718639034491224044092472",
"276804524050162312491394201439638407784",
"202162729365147225055122523831541834163",
"258443022141084620083467996827818789557",
"136064917169882702533832631864805001542",
"230129267169335292143702427799300256316",
"265309928074248253894880835292158015422",
"328999638794858182355607954333331960065",
"179479303807757933041573910995120245745",
"74089739675863529978553378934952175495",
"60349517840150194770256223067018105536",
"15161260480988151857064874119515091091",
"34543710426657214302992195293583966155",
"4811167292983850202205463008790553898",
"158079368675352879612400531228186316904",
"39910990466131085277061535198792471143",
"110286705769716929751746967632561317892",
"83038513222117233123108106475882841093",
"28572161854422777309079867968726122599",
"147370476724077546428568547457741928617",
"330391201491111936158476791635301609691",
"318143104910805103724000295029949104102",
"67761587178943039769138926552970678326"
],
"threshold": 0.9
},
"id": "CVE-2026-84449-472c4129",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/strukturag/libheif/commit/e29953da30eb11aa1762df0bff3b36be4b22fbe3",
"target": {
"file": "libheif/pixelimage.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"2858142600645346371739317549690862563",
"231652803217983046264222348339775207093",
"78128445677102475792092695600501362021",
"149220530933782321574221442632752885582",
"336827205224391327364112962568261127282",
"185717450213734980136697792342154251287",
"22182894274438587019671481543404941011",
"79371766126958366568192468568665450057",
"145027124722213043086415332783273094034",
"72471205371677092282066837221151858353",
"277075638405146798851002899900768830861",
"194126381603636120498707798088908028020",
"335240763817872602967368683661836978937",
"236135897884157608211983802024843644213",
"64169481976623210160477711576984644796",
"61423433267027914178186893877619143232",
"123539926017662547088543563574743415092",
"247784724733587094871592165123309106516",
"17132868668912111382958457586052499186",
"222081980459390380936925928370177975884",
"79927592630439748581423719016173094675",
"84963737821757015873486622031489413398",
"311284610015626066268802741526772791358"
],
"threshold": 0.9
},
"id": "CVE-2026-84449-51b03c6c",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/strukturag/libheif/commit/e29953da30eb11aa1762df0bff3b36be4b22fbe3",
"target": {
"file": "libheif/color-conversion/monochrome.cc"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "128854971836816337790533689332387414206",
"length": 424
},
"id": "CVE-2026-84449-5b9a59b5",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/strukturag/libheif/commit/e29953da30eb11aa1762df0bff3b36be4b22fbe3",
"target": {
"file": "libheif/api/libheif/heif.cc",
"function": "heif_image_get_plane_readonly"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"83674801257355227601913826167212692478",
"15893991322368001985236714293233859194",
"136563815837621440515070503833388623883",
"248176630969934416229062093390417519643",
"257395413436524983028024456292759631188",
"141765505755465093850541822332391504555",
"268918811763331511096642698970663404565",
"315839322930673338380501286107856440844",
"20830945491679673358739136807078926239",
"167615647904581116844590432007114037871",
"113486712877394707867505846002103041991",
"135217407151847827223574278640453072387",
"122620115296193595301121874939616974182",
"30443738384562197964108941570990034107",
"268925975862716177246679626765553698063",
"312164687081816569990095912037473583036",
"205180889750336413394578563373415883301",
"209928892563012026816986773457926487468",
"234858198624192720944268291243449619032",
"123059327406133659934780139481023854096",
"20423773263888407752810178419166727180",
"106546110469953102210616752735732725825",
"130016086775695060930502138087180872026",
"104240886958751583178731932684725915796",
"158790375201024858258269644176320040310",
"127917019519739988734360131405346199792",
"299017168022716384590426168415432071055",
"246555299321911405437034351403039832881",
"74496395246257502345730041113871000443",
"192950059045440660741997360641601607236",
"171854434039524993650839267818105623134",
"283764307113807203722381373056924599538",
"37761818876978655015874772729805745733",
"161498381980986340783709419293753316732",
"239382676675445997323731446530170132636",
"272395481807812438668665054622229678826",
"75608756726447169552539964794150435730",
"253014641260243057923264886532601290917",
"230013033073965994082176557676558317257",
"257888278153117216156355153342471306408",
"219699119252084726654123047926243605866",
"79232224468423805826432798787538682855",
"321091137261816669004970938702713627138",
"320010140332415268270157342654649877291",
"187646552353813892437599527218671528718",
"14423487594907452010677709290743649662",
"206899659738686123563551870923902768034",
"30816309643000134109632719165878147294",
"36602560487477901849151071165030997245",
"105985061489972335150975567068309938232",
"84558539637063172656733812525231002580",
"224000348454303400957256395925892431383",
"25052154160625862519503932834180925464",
"187330436829018266593712960020323844610",
"206708443613072481103173788392569952551",
"295503550603605588721469911584451270035",
"248241429618193482393908248044537878580",
"96720410726922929243009067617965885201",
"181606353485935685718859986594559681651",
"326405950492287357290175933359134657886",
"226286184817966941027829655707881960556",
"40337492629018905993918648875071736228",
"129436474621422422142708760405653145489",
"24522605933441369866679089278970925779",
"104628642381391384174252686426450618605",
"258228663123042956528454388903954996010",
"209751312934717820895768035204640233856",
"339881908708653256737578779822756221184",
"18728014868034550406650557751556688741",
"187944133557999032080389419474382972085",
"32710315508626973051200762248999315424",
"339884490442863918096728515498179160145",
"8081200696689364882732824760538450570",
"137044661689463578379691112573607315807",
"165494604848033770540584142948973358127",
"328409425341554226313129220415795860631",
"17540690760627444075841267937405490406",
"116909126706551325462548620424846967319",
"241383355980082601861498939486053257071",
"203008988674762285993449300207242736859"
],
"threshold": 0.9
},
"id": "CVE-2026-84449-68f79f10",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/strukturag/libheif/commit/e29953da30eb11aa1762df0bff3b36be4b22fbe3",
"target": {
"file": "libheif/api/libheif/heif_experimental.h"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"221507299325147672464567870467610987169",
"178234023144560658425699679412069800338",
"183218267024276407031372901299370892163",
"90757370385694550740997855416780859416",
"95277117371501622675972361292170256072",
"194368253136382555206676399613567056846",
"72598484538704392919010593072666718046",
"216990643287572071901201435030542488751",
"62699154490424361879796607357049753705",
"103068436916155766614359279780200569258",
"154771724290594147697155546822392617842",
"118910057522344443018249694727006422230",
"90996472118083761086745312414597410644",
"213324449904708281074330445805177901856",
"137356236519592424821205808888391946545",
"73789291565811165065507818875225513126",
"147528125041320762694795476389287290681"
],
"threshold": 0.9
},
"id": "CVE-2026-84449-71f727d3",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/strukturag/libheif/commit/e29953da30eb11aa1762df0bff3b36be4b22fbe3",
"target": {
"file": "libheif/color-conversion/rgb2yuv_sharp.cc"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "78628167829704971009517104133243217359",
"length": 406
},
"id": "CVE-2026-84449-7401be2e",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/strukturag/libheif/commit/e29953da30eb11aa1762df0bff3b36be4b22fbe3",
"target": {
"file": "libheif/api/libheif/heif.cc",
"function": "heif_image_get_plane"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"213078150342466854412720347597324164339",
"279962515314415213238357844890647164347",
"112509307631175615599722725265256078685",
"272815803365510422139564156872186729991",
"213078150342466854412720347597324164339",
"326155168362034367620998045501489439830",
"330429635728531488053087950552008306676",
"298906640477533417272381127892226785617",
"85494511566886802283837483327854396843",
"279412417836111651088400754115548449291",
"238452025066748105118792379945645559001",
"247878935203285742875069940608792705140",
"161239300098211807648884126444756645391",
"41489118486032024087245743071581110874",
"223409928484390643055163437316278480371",
"189135528271044461361374160680280387530",
"173209563201592021813722796852400187843",
"258108740959730984289894136269599981555",
"238452025066748105118792379945645559001",
"247878935203285742875069940608792705140"
],
"threshold": 0.9
},
"id": "CVE-2026-84449-74f99c5d",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/strukturag/libheif/commit/e29953da30eb11aa1762df0bff3b36be4b22fbe3",
"target": {
"file": "libheif/api/libheif/heif.cc"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "123304520627908797307394901754127062355",
"length": 4553
},
"id": "CVE-2026-84449-79f186bd",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/strukturag/libheif/commit/e29953da30eb11aa1762df0bff3b36be4b22fbe3",
"target": {
"file": "libheif/color-conversion/rgb2yuv.cc",
"function": "Op_RRGGBBxx_HDR_to_YCbCr420::convert_colorspace"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"146805409701923202452244330975405753619",
"97975550727221551209299804883452601145",
"30574178953772426188575800998004872598",
"17083673912542143632817549141914057802",
"310107291225900471511720706725032199864"
],
"threshold": 0.9
},
"id": "CVE-2026-84449-b50ee3c5",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/strukturag/libheif/commit/e29953da30eb11aa1762df0bff3b36be4b22fbe3",
"target": {
"file": "libheif/codecs/uncompressed/decoder_abstract.h"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"319764638794102433551642896101612645909",
"251409563006214936036920216608375204582",
"154343620878338196080528958453915698261",
"142704874644873910193535048161996798423",
"95903514441490022522774371932954688561",
"185387180880069874004310104521173805511",
"71851326620722031056205933605711927089",
"215046284481980592761200422689310864332",
"44844261668953686304980049952775467770",
"153312942162269387872826797008210397179",
"49692583523663891920132621676865156222",
"219052149313102615440805423140252354170",
"57294552302559089750897789717244167785",
"170648815394041690300268021432395021524",
"51147904488800139866835023889685510267",
"10994728461824964023895145566836416071",
"49692583523663891920132621676865156222",
"219052149313102615440805423140252354170",
"201091706724205147142270781463684129334",
"133041831931397556203349924868892442804",
"238599022614048058388521526864794772004",
"248748099335813797857390477017109561651",
"35928027707313054014646830110705299518",
"116023541250798735701198553761686872627"
],
"threshold": 0.9
},
"id": "CVE-2026-84449-b95a5c97",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/strukturag/libheif/commit/e29953da30eb11aa1762df0bff3b36be4b22fbe3",
"target": {
"file": "libheif/color-conversion/yuv2rgb.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"175484636553561128299962363661945648127",
"224778442838226324425177748401635771923",
"308643324627997281923609930228242314157",
"256138631196212772364267173201901062700",
"243101600982206190546564007244766743154",
"333891568846093203823938864800026378432",
"202427179784751675388878019721326325994",
"70462115337247064097940004255042494680",
"249292078426998291709571718139402172194",
"280336952714331823435527802731433849275",
"59862910445110696774940433832483967982",
"4569780213251014466614713701071009926",
"243101600982206190546564007244766743154",
"333891568846093203823938864800026378432",
"168860029531093691465521109709462316219",
"316403418481602678535666074206879045629"
],
"threshold": 0.9
},
"id": "CVE-2026-84449-c1c8c7aa",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/strukturag/libheif/commit/e29953da30eb11aa1762df0bff3b36be4b22fbe3",
"target": {
"file": "libheif/image-items/unc_image.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"102668940880389042614208610441300879590",
"137083334211594090865019933111447414768",
"50477949590246037910038612731369404561",
"182247077165585355200624386124960317954",
"248051867992373132840594052024687331601",
"191864188483162294700240105283863652864",
"289801252552501107411213959976077865604",
"90539963803795998426970518111012712602",
"193293619669950086781571485682737117099",
"825725546560347260403521272621201403",
"118590788413409132577159397770860648871",
"263985122787282456035757449746629562625",
"102668940880389042614208610441300879590",
"137083334211594090865019933111447414768",
"50477949590246037910038612731369404561",
"182247077165585355200624386124960317954",
"248051867992373132840594052024687331601",
"191864188483162294700240105283863652864",
"66832521798882037496612833724319800373",
"78512125590925112227193523096304756854",
"154519312070694595747676230997226094370",
"264235868831115049446303636407479418075",
"240565940600199591321265341355780993767",
"83573321402550507547815008205592642246",
"284875570139745148444176479996810077456",
"66832521798882037496612833724319800373",
"301264394890758819036964849009379269740",
"10849498960081342687433613534521055854",
"168585358516269612289375065250986435721",
"146586663150970740799421875875379204892",
"140283171412580674530743461276977733439",
"45266897053537820257609453504347731042",
"94142812859277988111777731909516961884",
"200222228146730674244866006676355398780",
"285296439671797176040413641422969934151",
"274727095038507311352186595745551828151",
"47190930000815929613304473988767485154",
"270666480589350477230566939808369891554",
"311544282436600477914107624524552671624",
"176574938285485419861913133370491806663",
"317926152416508141945716521182921988594",
"89478554484876772591856093578685867646"
],
"threshold": 0.9
},
"id": "CVE-2026-84449-ca9dd637",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/strukturag/libheif/commit/e29953da30eb11aa1762df0bff3b36be4b22fbe3",
"target": {
"file": "libheif/color-conversion/rgb2rgb.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"16988138163497670559048984564344863834",
"8745357194346710301924657671161471346",
"158164661363296728163954972272031916343",
"302396519774281896314207470752164653280",
"178399038727466967158426142280227291739",
"147962956948223671853021978163476487760",
"212234842756676133668080339273243736754",
"261537459744596043331546664289323383382",
"5061663041758702361921582350160084850",
"25981899782822062280834554567148895676",
"1089010354326327337186400016499885120",
"2576236337180251291781613323927379071",
"216002306375497062788987106196616090003",
"127177430895859312751353497582012287759",
"316231450904829519471334465875337615753",
"223318731369314486464872376465576025338",
"172523187198569543012118094857098015311",
"151812619708532781037789931427820770210",
"168774466852709266101595009248203446569",
"314395073882680065501365891700063563207",
"25121052581086068130132900453124517779"
],
"threshold": 0.9
},
"id": "CVE-2026-84449-cc8b5f96",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/strukturag/libheif/commit/e29953da30eb11aa1762df0bff3b36be4b22fbe3",
"target": {
"file": "libheif/color-conversion/hdr_sdr.cc"
}
}
]
vanir_signatures_modified
"2026-09-24T08:06:43Z"