{"id":"CVE-2026-84449","summary":"libheif hOp_RGB24_32_to_YCbCr Memory Access Error / SEGV","details":"libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.19.6, Op_RGB24_32_to_YCbCr::convert_colorspace() stores image-plane strides in an integer width that can overflow for extremely large RGB images created through heif_image_create() and heif_image_add_plane(). The resulting wrapped stride causes the conversion loop in libheif/color-conversion/rgb2yuv.cc to compute an invalid input pointer and read beyond the allocated interleaved plane while heif_context_encode_image() performs RGB-to-YCbCr conversion. This can crash the encoding process. This issue is fixed in version 1.19.6.","aliases":["GHSA-2c3g-p585-8rpq"],"modified":"2026-09-30T18:27:17.394658730Z","published":"2026-09-18T16:03:28.532Z","related":["openSUSE-SU-2026:11921-1"],"database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-125","CWE-190"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84449.json"},"references":[{"type":"WEB","url":"https://github.com/strukturag/libheif/releases/tag/v1.19.6"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84449.json"},{"type":"ADVISORY","url":"https://github.com/strukturag/libheif/security/advisories/GHSA-2c3g-p585-8rpq"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84449"},{"type":"FIX","url":"https://github.com/strukturag/libheif/commit/e29953da30eb11aa1762df0bff3b36be4b22fbe3"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/strukturag/libheif","events":[{"introduced":"0"},{"fixed":"e29953da30eb11aa1762df0bff3b36be4b22fbe3"},{"fixed":"2fff74c0a2627af87370e88aa1b92ca87ed45c9e"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"1.19.6"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["v1.19.5","v1.19.4","v1.19.3","v1.19.2","v1.19.1","v1.19.0","v1.18.0","v1.18.0-rc1","v1.17.6","v1.17.5","v1.17.4","v1.17.3","v1.17.2","v1.17.1","v1.17.0","v1.16.2","v1.16.1","v1.16.0","v1.15.2","v1.15.1","v1.15.0","v1.14.2","v1.14.1","v1.14.0","v1.13.0","v1.12.0","v1.11.0","v1.10.0","v1.9.1","v1.9.0","v1.8.0","v1.7.0","v1.3.2","v1.3.1","v1.3.0","v1.2.0","v1.1.0"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-84449.json","vanir_signatures_modified":"2026-09-24T08:06:43Z","vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["179328677177137954234807181024890845712","93534713415797560513386777094146548506","21183482683050143622360730610937334817","313657260711055404659488435757039008734","331994909722299205945920664753525222435","246580420481345094818193102253735445572","66832521798882037496612833724319800373","2362331427678903563216591128875157082","297702696074947045229079218293077761294","67519056256246979064598381107440148952","29091392131752372052130660839614196906","2443578288335845819316381250687301295","175244968109534058661105453159732178533","201207249599421137379118651860786976733","83308151607106994484315968396767224791","65178013787154873702426177758707662936","281927549270387561162096785913794376951","256598043387544909344970080415286821988","207243987260890374705019664016717227362","11206308316173162750637399463808358501","162729343568683709647965270346686355604","276144373869456888790887726892503765859","287650996955604403489383002779653820209","73415410408650101924480174679534195330","312748764050335460275548889956929675523","11206308316173162750637399463808358501","162729343568683709647965270346686355604","276144373869456888790887726892503765859"],"threshold":0.9},"id":"CVE-2026-84449-277e2872","signature_type":"Line","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/e29953da30eb11aa1762df0bff3b36be4b22fbe3","target":{"file":"libheif/color-conversion/rgb2yuv.cc"}},{"target":{"file":"libheif/image-items/mask_image.cc"},"deprecated":false,"digest":{"line_hashes":["234494363333151829402393693856674331097","2862738862703939022201016593223122926","29581731580130140978632457232548562892","21079495303383478544610420766495826265","29991610885572445665308960357652417086","255986299423770698994153559912869109560","334909597946308594758815056722385404224","33152657341869196803808051922885952652"],"threshold":0.9},"id":"CVE-2026-84449-34d884ea","signature_type":"Line","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/e29953da30eb11aa1762df0bff3b36be4b22fbe3"},{"digest":{"line_hashes":["319764638794102433551642896101612645909","280778317919159476114224262596689742217","32303247694493427818317182467662893019","102772476972663660957999986050052173994","129931732860249110229852744804388885650","55779273007327414569926407554846270841","319764638794102433551642896101612645909","280778317919159476114224262596689742217","32303247694493427818317182467662893019","102772476972663660957999986050052173994","129931732860249110229852744804388885650","55779273007327414569926407554846270841","319764638794102433551642896101612645909","280778317919159476114224262596689742217","32303247694493427818317182467662893019","102772476972663660957999986050052173994","129931732860249110229852744804388885650","55779273007327414569926407554846270841","319764638794102433551642896101612645909","280778317919159476114224262596689742217","32303247694493427818317182467662893019","102772476972663660957999986050052173994","129931732860249110229852744804388885650","55779273007327414569926407554846270841"],"threshold":0.9},"id":"CVE-2026-84449-3926e6bf","signature_type":"Line","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/e29953da30eb11aa1762df0bff3b36be4b22fbe3","target":{"file":"libheif/color-conversion/chroma_sampling.cc"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/e29953da30eb11aa1762df0bff3b36be4b22fbe3","target":{"file":"libheif/pixelimage.h"},"deprecated":false,"digest":{"line_hashes":["61216950609378154299658942288227315951","10410881776912379923720782706149761797","223743474504861833980033509208707949787","52415347561878277601352003521407586574","130508437175485232846264015538990075560","246498114212532577715262301639219353248","230559394299654918668378595241812458623","91338790179957514473242333196346055730","241996748628602950312114248648168302721","76755012389065774731513776093658215812","335948169066805918616432231235223787620"],"threshold":0.9},"id":"CVE-2026-84449-3efe1bf7","signature_type":"Line"},{"digest":{"line_hashes":["162970813286118467602832741271203463832","329293940590192702920687412482776693091","283988350725997310606117207763303494831","167036811486252157562489051296999414445","233245139646846745215520939039224639233","23220903089427407522939116027502042044","162970813286118467602832741271203463832","329293940590192702920687412482776693091","283988350725997310606117207763303494831","252992051448854314797557571816825585401","122853963298324020725025857819643442785","242290582541269767794223324599346205878","161215053103717280392846071656955989496","147322289880562957688831277245737774976","233914073859692656207842201241854663306","292778596600160089640687343136380402608","325147446250604498329143424265012941585","35375246951941065493146795228645755765","62514555671312353444996302116305066636","272264439811797568577288743895722031662","220892746966489876443289863117518546796","189666005257298631127659581773904786287","56138240523283664761118601684837386762","140781652082839346730553144531922788607","100522323959736511160508644541559686589","221267105449175471214468631857178173830","285916605131832225000221950187294526860","109932417942191155730717561062091221666","163399792199904647502017177865421009974","50185434106855718639034491224044092472","276804524050162312491394201439638407784","202162729365147225055122523831541834163","258443022141084620083467996827818789557","136064917169882702533832631864805001542","230129267169335292143702427799300256316","265309928074248253894880835292158015422","328999638794858182355607954333331960065","179479303807757933041573910995120245745","74089739675863529978553378934952175495","60349517840150194770256223067018105536","15161260480988151857064874119515091091","34543710426657214302992195293583966155","4811167292983850202205463008790553898","158079368675352879612400531228186316904","39910990466131085277061535198792471143","110286705769716929751746967632561317892","83038513222117233123108106475882841093","28572161854422777309079867968726122599","147370476724077546428568547457741928617","330391201491111936158476791635301609691","318143104910805103724000295029949104102","67761587178943039769138926552970678326"],"threshold":0.9},"id":"CVE-2026-84449-472c4129","signature_type":"Line","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/e29953da30eb11aa1762df0bff3b36be4b22fbe3","target":{"file":"libheif/pixelimage.cc"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/e29953da30eb11aa1762df0bff3b36be4b22fbe3","target":{"file":"libheif/color-conversion/monochrome.cc"},"deprecated":false,"digest":{"line_hashes":["2858142600645346371739317549690862563","231652803217983046264222348339775207093","78128445677102475792092695600501362021","149220530933782321574221442632752885582","336827205224391327364112962568261127282","185717450213734980136697792342154251287","22182894274438587019671481543404941011","79371766126958366568192468568665450057","145027124722213043086415332783273094034","72471205371677092282066837221151858353","277075638405146798851002899900768830861","194126381603636120498707798088908028020","335240763817872602967368683661836978937","236135897884157608211983802024843644213","64169481976623210160477711576984644796","61423433267027914178186893877619143232","123539926017662547088543563574743415092","247784724733587094871592165123309106516","17132868668912111382958457586052499186","222081980459390380936925928370177975884","79927592630439748581423719016173094675","84963737821757015873486622031489413398","311284610015626066268802741526772791358"],"threshold":0.9},"id":"CVE-2026-84449-51b03c6c"},{"target":{"file":"libheif/api/libheif/heif.cc","function":"heif_image_get_plane_readonly"},"deprecated":false,"digest":{"function_hash":"128854971836816337790533689332387414206","length":424},"id":"CVE-2026-84449-5b9a59b5","signature_type":"Function","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/e29953da30eb11aa1762df0bff3b36be4b22fbe3"},{"target":{"file":"libheif/api/libheif/heif_experimental.h"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["83674801257355227601913826167212692478","15893991322368001985236714293233859194","136563815837621440515070503833388623883","248176630969934416229062093390417519643","257395413436524983028024456292759631188","141765505755465093850541822332391504555","268918811763331511096642698970663404565","315839322930673338380501286107856440844","20830945491679673358739136807078926239","167615647904581116844590432007114037871","113486712877394707867505846002103041991","135217407151847827223574278640453072387","122620115296193595301121874939616974182","30443738384562197964108941570990034107","268925975862716177246679626765553698063","312164687081816569990095912037473583036","205180889750336413394578563373415883301","209928892563012026816986773457926487468","234858198624192720944268291243449619032","123059327406133659934780139481023854096","20423773263888407752810178419166727180","106546110469953102210616752735732725825","130016086775695060930502138087180872026","104240886958751583178731932684725915796","158790375201024858258269644176320040310","127917019519739988734360131405346199792","299017168022716384590426168415432071055","246555299321911405437034351403039832881","74496395246257502345730041113871000443","192950059045440660741997360641601607236","171854434039524993650839267818105623134","283764307113807203722381373056924599538","37761818876978655015874772729805745733","161498381980986340783709419293753316732","239382676675445997323731446530170132636","272395481807812438668665054622229678826","75608756726447169552539964794150435730","253014641260243057923264886532601290917","230013033073965994082176557676558317257","257888278153117216156355153342471306408","219699119252084726654123047926243605866","79232224468423805826432798787538682855","321091137261816669004970938702713627138","320010140332415268270157342654649877291","187646552353813892437599527218671528718","14423487594907452010677709290743649662","206899659738686123563551870923902768034","30816309643000134109632719165878147294","36602560487477901849151071165030997245","105985061489972335150975567068309938232","84558539637063172656733812525231002580","224000348454303400957256395925892431383","25052154160625862519503932834180925464","187330436829018266593712960020323844610","206708443613072481103173788392569952551","295503550603605588721469911584451270035","248241429618193482393908248044537878580","96720410726922929243009067617965885201","181606353485935685718859986594559681651","326405950492287357290175933359134657886","226286184817966941027829655707881960556","40337492629018905993918648875071736228","129436474621422422142708760405653145489","24522605933441369866679089278970925779","104628642381391384174252686426450618605","258228663123042956528454388903954996010","209751312934717820895768035204640233856","339881908708653256737578779822756221184","18728014868034550406650557751556688741","187944133557999032080389419474382972085","32710315508626973051200762248999315424","339884490442863918096728515498179160145","8081200696689364882732824760538450570","137044661689463578379691112573607315807","165494604848033770540584142948973358127","328409425341554226313129220415795860631","17540690760627444075841267937405490406","116909126706551325462548620424846967319","241383355980082601861498939486053257071","203008988674762285993449300207242736859"]},"id":"CVE-2026-84449-68f79f10","signature_type":"Line","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/e29953da30eb11aa1762df0bff3b36be4b22fbe3"},{"id":"CVE-2026-84449-71f727d3","signature_type":"Line","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/e29953da30eb11aa1762df0bff3b36be4b22fbe3","target":{"file":"libheif/color-conversion/rgb2yuv_sharp.cc"},"deprecated":false,"digest":{"line_hashes":["221507299325147672464567870467610987169","178234023144560658425699679412069800338","183218267024276407031372901299370892163","90757370385694550740997855416780859416","95277117371501622675972361292170256072","194368253136382555206676399613567056846","72598484538704392919010593072666718046","216990643287572071901201435030542488751","62699154490424361879796607357049753705","103068436916155766614359279780200569258","154771724290594147697155546822392617842","118910057522344443018249694727006422230","90996472118083761086745312414597410644","213324449904708281074330445805177901856","137356236519592424821205808888391946545","73789291565811165065507818875225513126","147528125041320762694795476389287290681"],"threshold":0.9}},{"id":"CVE-2026-84449-7401be2e","signature_type":"Function","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/e29953da30eb11aa1762df0bff3b36be4b22fbe3","target":{"file":"libheif/api/libheif/heif.cc","function":"heif_image_get_plane"},"deprecated":false,"digest":{"function_hash":"78628167829704971009517104133243217359","length":406}},{"deprecated":false,"digest":{"line_hashes":["213078150342466854412720347597324164339","279962515314415213238357844890647164347","112509307631175615599722725265256078685","272815803365510422139564156872186729991","213078150342466854412720347597324164339","326155168362034367620998045501489439830","330429635728531488053087950552008306676","298906640477533417272381127892226785617","85494511566886802283837483327854396843","279412417836111651088400754115548449291","238452025066748105118792379945645559001","247878935203285742875069940608792705140","161239300098211807648884126444756645391","41489118486032024087245743071581110874","223409928484390643055163437316278480371","189135528271044461361374160680280387530","173209563201592021813722796852400187843","258108740959730984289894136269599981555","238452025066748105118792379945645559001","247878935203285742875069940608792705140"],"threshold":0.9},"id":"CVE-2026-84449-74f99c5d","signature_type":"Line","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/e29953da30eb11aa1762df0bff3b36be4b22fbe3","target":{"file":"libheif/api/libheif/heif.cc"}},{"digest":{"function_hash":"123304520627908797307394901754127062355","length":4553},"id":"CVE-2026-84449-79f186bd","signature_type":"Function","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/e29953da30eb11aa1762df0bff3b36be4b22fbe3","target":{"file":"libheif/color-conversion/rgb2yuv.cc","function":"Op_RRGGBBxx_HDR_to_YCbCr420::convert_colorspace"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/e29953da30eb11aa1762df0bff3b36be4b22fbe3","target":{"file":"libheif/codecs/uncompressed/decoder_abstract.h"},"deprecated":false,"digest":{"line_hashes":["146805409701923202452244330975405753619","97975550727221551209299804883452601145","30574178953772426188575800998004872598","17083673912542143632817549141914057802","310107291225900471511720706725032199864"],"threshold":0.9},"id":"CVE-2026-84449-b50ee3c5"},{"source":"https://github.com/strukturag/libheif/commit/e29953da30eb11aa1762df0bff3b36be4b22fbe3","target":{"file":"libheif/color-conversion/yuv2rgb.cc"},"deprecated":false,"digest":{"line_hashes":["319764638794102433551642896101612645909","251409563006214936036920216608375204582","154343620878338196080528958453915698261","142704874644873910193535048161996798423","95903514441490022522774371932954688561","185387180880069874004310104521173805511","71851326620722031056205933605711927089","215046284481980592761200422689310864332","44844261668953686304980049952775467770","153312942162269387872826797008210397179","49692583523663891920132621676865156222","219052149313102615440805423140252354170","57294552302559089750897789717244167785","170648815394041690300268021432395021524","51147904488800139866835023889685510267","10994728461824964023895145566836416071","49692583523663891920132621676865156222","219052149313102615440805423140252354170","201091706724205147142270781463684129334","133041831931397556203349924868892442804","238599022614048058388521526864794772004","248748099335813797857390477017109561651","35928027707313054014646830110705299518","116023541250798735701198553761686872627"],"threshold":0.9},"id":"CVE-2026-84449-b95a5c97","signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/e29953da30eb11aa1762df0bff3b36be4b22fbe3","target":{"file":"libheif/image-items/unc_image.cc"},"deprecated":false,"digest":{"line_hashes":["175484636553561128299962363661945648127","224778442838226324425177748401635771923","308643324627997281923609930228242314157","256138631196212772364267173201901062700","243101600982206190546564007244766743154","333891568846093203823938864800026378432","202427179784751675388878019721326325994","70462115337247064097940004255042494680","249292078426998291709571718139402172194","280336952714331823435527802731433849275","59862910445110696774940433832483967982","4569780213251014466614713701071009926","243101600982206190546564007244766743154","333891568846093203823938864800026378432","168860029531093691465521109709462316219","316403418481602678535666074206879045629"],"threshold":0.9},"id":"CVE-2026-84449-c1c8c7aa","signature_type":"Line"},{"signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/e29953da30eb11aa1762df0bff3b36be4b22fbe3","target":{"file":"libheif/color-conversion/rgb2rgb.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["102668940880389042614208610441300879590","137083334211594090865019933111447414768","50477949590246037910038612731369404561","182247077165585355200624386124960317954","248051867992373132840594052024687331601","191864188483162294700240105283863652864","289801252552501107411213959976077865604","90539963803795998426970518111012712602","193293619669950086781571485682737117099","825725546560347260403521272621201403","118590788413409132577159397770860648871","263985122787282456035757449746629562625","102668940880389042614208610441300879590","137083334211594090865019933111447414768","50477949590246037910038612731369404561","182247077165585355200624386124960317954","248051867992373132840594052024687331601","191864188483162294700240105283863652864","66832521798882037496612833724319800373","78512125590925112227193523096304756854","154519312070694595747676230997226094370","264235868831115049446303636407479418075","240565940600199591321265341355780993767","83573321402550507547815008205592642246","284875570139745148444176479996810077456","66832521798882037496612833724319800373","301264394890758819036964849009379269740","10849498960081342687433613534521055854","168585358516269612289375065250986435721","146586663150970740799421875875379204892","140283171412580674530743461276977733439","45266897053537820257609453504347731042","94142812859277988111777731909516961884","200222228146730674244866006676355398780","285296439671797176040413641422969934151","274727095038507311352186595745551828151","47190930000815929613304473988767485154","270666480589350477230566939808369891554","311544282436600477914107624524552671624","176574938285485419861913133370491806663","317926152416508141945716521182921988594","89478554484876772591856093578685867646"]},"id":"CVE-2026-84449-ca9dd637","signature_type":"Line"},{"signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/e29953da30eb11aa1762df0bff3b36be4b22fbe3","target":{"file":"libheif/color-conversion/hdr_sdr.cc"},"deprecated":false,"digest":{"line_hashes":["16988138163497670559048984564344863834","8745357194346710301924657671161471346","158164661363296728163954972272031916343","302396519774281896314207470752164653280","178399038727466967158426142280227291739","147962956948223671853021978163476487760","212234842756676133668080339273243736754","261537459744596043331546664289323383382","5061663041758702361921582350160084850","25981899782822062280834554567148895676","1089010354326327337186400016499885120","2576236337180251291781613323927379071","216002306375497062788987106196616090003","127177430895859312751353497582012287759","316231450904829519471334465875337615753","223318731369314486464872376465576025338","172523187198569543012118094857098015311","151812619708532781037789931427820770210","168774466852709266101595009248203446569","314395073882680065501365891700063563207","25121052581086068130132900453124517779"],"threshold":0.9},"id":"CVE-2026-84449-cc8b5f96","signature_type":"Line"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"}]}