CVE-2026-84447CWE-770denial-of-service

CVE-2026-84447

High · published September 18, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
43.2
In the wild
Unconfirmed
What it is

libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.1 and earlier, crafted grid, iovl, and iden reference graphs can repeatedly decode the same base image because processed_ids is copied per branch and ImageItem::decode_image() has no shared operation budget. This vulnerability is fixed in 1.23.2.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00517 · 43.2th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2026-09-18T20:17Z
References (4)
https://github.com/strukturag/libheif/commit/30b52a4e829efe0ee6d7208e8500b99f664af5e9 · [email protected]https://github.com/strukturag/libheif/releases/tag/v1.23.2 · [email protected]https://github.com/strukturag/libheif/security/advisories/GHSA-x8xm-cm2c-cfc8 · [email protected]https://github.com/strukturag/libheif/security/advisories/GHSA-x8xm-cm2c-cfc8 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 20 SEP 03:24Z
    EPSS moved — → 1%
    epss
  • 18 SEP 16:00Z
    libheif: Derived-image indirect reference chains and tiled offsets bypass decode caching and MemoryHandle limits, causing CPU/memory amplification DoS
    cvelistv5