strukturag libheif: memory corruption

strukturag libheif

libheif is a HEIF and AVIF file format decoder and encoder. From 1.22.0 until 1.23.2, a crafted HEIF, HEIC, or AVIF item graph using nested iden and auxl references can make HeifPixelImage::transfer_channel_from_image_as() append duplicate Alpha planes with different bit depths to m_storage.

Fix it

Upgrade to libheif is a 1.23.2

First seen: 28 Oct 2026
Last update: 28 Oct 2026, 19:17 UTC
Fixed in: 1.23.2
Identifiers: CVE-2026-84383
CVSS: 9.8
Source: news

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## strukturag libheif: memory corruption
Severity: critical. Patch status: patched.
Affected: strukturag libheif
Fixed in: 1.23.2
Ids: CVE-2026-84383

libheif is a HEIF and AVIF file format decoder and encoder. From 1.22.0 until 1.23.2, a crafted HEIF, HEIC, or AVIF item graph using nested iden and auxl references can make HeifPixelImage::transfer_channel_from_image_as() append duplicate Alpha planes with different bit depths to m_storage.

## Steps
1. Search the repo, its CI and infra config for strukturag libheif. If present, report the version in use and whether it's affected.
2. Fix by release line: libheif is a: >= 1.22.0 < 1.23.2 → 1.23.2.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| libheif is a >= 1.22.0 < 1.23.2 | fixed | 1.23.2 | — |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-84383") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://github.com/strukturag/libheif/commit/f4fb8bde4704ebb46e46ff9fb94407c9774153b2 https://nvd.nist.gov/vuln/detail/CVE-2026-84383
https://pwned.coffee/i/libheif-is-a-heif-and-avif-file-format-decoder-and-encod-cve-2026-84383

Timeline

28 Oct 2026, 19:17 UTC
Fix status: unknown → patched.
28 Oct 2026
First reported.

Receipt

Exploitation: Public exploit code, no attacks reported
CISA ADP “CISA ADP rates exploitation of CVE-2026-84383 "poc" (SSVC).” source
Fix by release line: Product Affected Fixed in Source
libheif is a >= 1.22.0, < 1.23.2 1.23.2 CVE record (CNA) checked 28 Oct
Score: CVSS 9.8 (critical). CVSS 3.1 9.8 (CNA GitHub_M) for CVE-2026-84383
Last checked: 28 Oct 2026, 19:17 UTC

Product	Affected	Fixed in	Source
libheif is a	>= 1.22.0, < 1.23.2	1.23.2	CVE record (CNA) checked 28 Oct

Sources: KEV – CVE record ✓ Vendor ✓

Sources

Wrong fix version, or a source we missed? Send it back to chef@pwned.coffee with the source, and we'll correct it here.

Totalone very hot coffee