CVE-2026-84383: Heap overflow in libheif

CVE-2026-84383 is a heap out-of-bounds write vulnerability in libheif, library for decoding HEIF, HEIC, and AVIF files. A crafted file with nested iden and auxl references causes duplicate Alpha planes with different bit depths (8, 10, 12 bits). The scale_nearest_neighbor() function allocates the Alpha plane in 8-bit depth but processes subsequent 10-12 bit components, writing uint16_t samples into 8-bit allocated memory, causing overflow. It affects any application decoding HEIF/AVIF files: browsers, cloud services, photo editors.

CVSS 9.8 critical: overflow controlled by output geometry and sample values allows arbitrary code execution. Patch available in 1.23.2 as of 2026-09-18. GitHub signals detected 2026-10-28 indicate community attention; no publicly confirmed exploit in official data.

System administrators and CISOs must immediately upgrade libheif to version 1.23.2 or later on all systems processing HEIF/AVIF files (web servers, media services, containers, design workstations). Check indirect dependencies via dependency scanner. If immediate patching is not possible, restrict HEIF/AVIF file uploads and processing to trusted users and isolate affected systems from critical networks.