OPENSUSE-SU-2026:21889-1
Vulnerability from csaf_opensuse - Published: 2026-09-20 12:44 - Updated: 2026-11-15 21:11Summary
Security update for libheif
Severity
Important
Notes
Title of the patch: Security update for libheif
Description of the patch: This update for libheif fixes the following issues:
- CVE-2026-84383: Heap buffer overflow in scale_nearest_neighbor() via duplicate alpha planes from nested iden/auxl
items (bsc#1279443).
- CVE-2026-84384: brotli/zlib decompression paths lack output-size limits, allowing decompression-bomb OOM/DoS
(bsc#1279445).
- CVE-2026-84444: Out-of-bounds write in the unci encoder (bsc#1279448).
- CVE-2026-84446: Sequence decode timing-table initialization allows non-terminating loops and unbounded memory,
bypassing max_sequence_frames (bsc#1279447).
- CVE-2026-84447: Derived-image indirect reference chains and tiled offsets bypass decode caching and MemoryHandle
limits, causing CPU/memory amplification DoS (bsc#1279446).
- CVE-2026-84448: Heap out-of-bounds read in the inline-mask region API (bsc#1279449).
- CVE-2026-84450: image item with `clap` property and an ispe declaring a dimension greater than `INT32_MAX + 1` can
lead to a crash via an abort (bsc#1280002).
- CVE-2026-84451: crafted HEIF file advertising a 4096 4096 uncompressed tile grid can cause an out-of-bounds read due
to an integer overflow (bsc#1280001).
- Heap out-of-bounds write in the uncompressed encoder for RRGGBB images with interleaved bit-depth <= 8 (bsc#1273083).
- Out-of-bounds read and write in derived-item and pixel-plane handling (bsc#1279444).
Changes for libheif:
- Update to version 1.23.4:
* CVE-2026-XXXXX: The max_items security limit was not enforced
for the child boxes of iinf, so a file could declare an
unbounded number of items.
* CVE-2026-XXXXX: Unbounded recursion in the reference-cycle
check crashed the parser on a long chain of derived items,
without bound when the item-count limit is disabled.
* CVE-2026-XXXXX: Permanent decoder deadlock through a lock-order
inversion in parallel grid tile decoding (enabled by default).
* CVE-2026-XXXXX: Heap out-of-bounds read in the encoder pluginsi
for images whose luma and chroma bit depths differ.
* CVE-2026-XXXXX: Unreclaimable memory leak in
heif_track_get_next_raw_sequence_sample().
* CVE-2026-XXXXX: Heap out-of-bounds read in the WebCodecs
decoder plugin
- includes fixes from 1.23.3:
* CVE-2026-XXXXX: Heap buffer overflow (write) in the
uncompressed (unci) mixed-interleave decoder when the two
chroma components declare different bit depths.
* CVE-2026-XXXXX: Permanent decoder deadlock through a reference
cycle between an image and its alpha auxiliary image.
* CVE-2026-XXXXX: Heap out-of-bounds read in the YCbCr 4:2:0 to
16-bit interleaved RGB conversion when the chroma planes have a
lower bit depth than luma
* CVE-2026-XXXXX: Heap buffer overflow in the SVT-AV1 encoder
plugin when encoding a high-bit-depth alpha channel, and a
double free on its send-picture error path.
* CVE-2026-84451: Incomplete fix: the tile range check of the
unci decoder (without icef) could still overflow, allowing an
out-of-bounds read
* CVE-2026-XXXXX: Heap out-of-bounds read when converting odd-
height 4:2:0 frames of an uncompressed (uncv) image sequence to
RGB.
* CVE-2026-XXXXX: Out-of-bounds read in the RGB to YCbCr identity-
matrix color conversion when the R, G, and B planes have
different bit depths
* CVE-2026-84450: A clap property combined with an oversized ispe
reached an assert() in the Fraction arithmetic and aborted the
process (incomplete fix). An error is returned instead.
* Fix Several smaller findings
* Fix Undefined behavior (negative shift) in the HDR bit-depth
up-conversion for target bit depths above 16. Such conversions
are now rejected.
* A number of bug fixes
- Update to version 1.23.2: [jsc#PED-16355]
* CVE-2026-84383: Heap buffer overflow in
scale_nearest_neighbor() via duplicate alpha planes from
nested iden/auxl items. (boo#CVE-2026-84383)
* Out-of-bounds read and write in derived-item and pixel-plane
handling. Through iden and auxl item chains, a crafted file
could attach pixel planes whose size differs from the image
geometry; crop, scale, and plane-extraction code then indexed
those planes with the wrong size. A working code-execution
exploit was confirmed. Plane sizes are now validated wherever
they are consumed. (boo#1279444)
* CVE-2026-84384: brotli/zlib decompression of mime metadata
and unci image data had no effective output-size limit, so a
decompression bomb could exhaust memory. Decompressed output
is now bounded by the security limits. (boo#1279445)
* CVE-2026-84447: Chains of derived-image references (grid,
iovl, iden) bypassed decode caching and memory limits, causing
CPU and memory amplification. (boo#1279446)
* CVE-2026-84446: Sequence sample-timing initialization could
produce non-terminating decode loops and unbounded memory,
bypassing max_sequence_frames. (boo#1279447)
* CVE-2026-84444: Out-of-bounds write in the unci encoder when
heif_context_add_image_tile() is given a tile whose planes do
not match its declared size. (boo#1279448)
* CVE-2026-84448: Heap out-of-bounds read in the inline-mask
region API when mask_data_len does not match the region
geometry. (boo#1279449)
* C++ exceptions such as std::bad_alloc can no longer escape the
C API read/decode entry points; they are returned as a
heif_error instead of aborting the process
* assert()s in the pixel-image plane allocation were replaced by
runtime errors
* stts/ctts tables describing more samples than the track can
have are rejected
* pclr (JPEG 2000 palette) box: the number of palette entries is
bounded by the box size
* BitReader::skip_bytes() is now constant time (fixes a fuzzer
timeout on bogus alignment values)
* iden items now validate the decoded image size like all other
items
* The uncompressed (unci) encoder rejects images without pixel
planes
* meta, mini, and moov boxes with size 0 (extending to the end of
the file) are now parsed correctly
* Fixed an integer overflow when probing the file size
* Fixed undefined behavior (signed shift) when reading the NAL
unit length in the OpenH264 decoder
* heif_region_item_add_region_inline_mask_data() now requires
non-zero width and height and the mask_data_len must equal
the expected (width * height + 7) / 8; otherwise it returns
an error instead of storing the mask
* heif_image_add_plane() returns an error instead of aborting
for bit depths outside 1..128 or interleaved component counts
outside 1..255
Patchnames: openSUSE-Leap-16.0-1716
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
8.1 (High)
Affected products
Recommended
42 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:libheif-svtenc-0:1.23.4-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:libheif-svtenc-0:1.23.4-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
42 products, the same list as for
CVE-2026-84383
Threats
Impact
important
8.1 (High)
Affected products
Recommended
42 products, the same list as for
CVE-2026-84383
Threats
Impact
important
7.5 (High)
Affected products
Recommended
42 products, the same list as for
CVE-2026-84383
Threats
Impact
important
7.5 (High)
Affected products
Recommended
42 products, the same list as for
CVE-2026-84383
Threats
Impact
important
6.8 (Medium)
Affected products
Recommended
42 products, the same list as for
CVE-2026-84383
Threats
Impact
moderate
7.5 (High)
Affected products
Recommended
42 products, the same list as for
CVE-2026-84383
Threats
Impact
important
7.5 (High)
Affected products
Recommended
42 products, the same list as for
CVE-2026-84383
Threats
Impact
important
References
36 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for libheif",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for libheif fixes the following issues:\n\n- CVE-2026-84383: Heap buffer overflow in scale_nearest_neighbor() via duplicate alpha planes from nested iden/auxl\n items (bsc#1279443).\n- CVE-2026-84384: brotli/zlib decompression paths lack output-size limits, allowing decompression-bomb OOM/DoS\n (bsc#1279445).\n- CVE-2026-84444: Out-of-bounds write in the unci encoder (bsc#1279448).\n- CVE-2026-84446: Sequence decode timing-table initialization allows non-terminating loops and unbounded memory,\n bypassing max_sequence_frames (bsc#1279447).\n- CVE-2026-84447: Derived-image indirect reference chains and tiled offsets bypass decode caching and MemoryHandle\n limits, causing CPU/memory amplification DoS (bsc#1279446).\n- CVE-2026-84448: Heap out-of-bounds read in the inline-mask region API (bsc#1279449).\n- CVE-2026-84450: image item with `clap` property and an ispe declaring a dimension greater than `INT32_MAX + 1` can\n lead to a crash via an abort (bsc#1280002).\n- CVE-2026-84451: crafted HEIF file advertising a 4096 4096 uncompressed tile grid can cause an out-of-bounds read due\n to an integer overflow (bsc#1280001).\n- Heap out-of-bounds write in the uncompressed encoder for RRGGBB images with interleaved bit-depth \u003c= 8 (bsc#1273083).\n- Out-of-bounds read and write in derived-item and pixel-plane handling (bsc#1279444).\n\nChanges for libheif:\n\n- Update to version 1.23.4:\n * CVE-2026-XXXXX: The max_items security limit was not enforced\n for the child boxes of iinf, so a file could declare an\n unbounded number of items.\n * CVE-2026-XXXXX: Unbounded recursion in the reference-cycle\n check crashed the parser on a long chain of derived items,\n without bound when the item-count limit is disabled.\n * CVE-2026-XXXXX: Permanent decoder deadlock through a lock-order\n inversion in parallel grid tile decoding (enabled by default).\n * CVE-2026-XXXXX: Heap out-of-bounds read in the encoder pluginsi\n for images whose luma and chroma bit depths differ.\n * CVE-2026-XXXXX: Unreclaimable memory leak in\n heif_track_get_next_raw_sequence_sample().\n * CVE-2026-XXXXX: Heap out-of-bounds read in the WebCodecs\n decoder plugin\n- includes fixes from 1.23.3:\n * CVE-2026-XXXXX: Heap buffer overflow (write) in the\n uncompressed (unci) mixed-interleave decoder when the two\n chroma components declare different bit depths.\n * CVE-2026-XXXXX: Permanent decoder deadlock through a reference\n cycle between an image and its alpha auxiliary image.\n * CVE-2026-XXXXX: Heap out-of-bounds read in the YCbCr 4:2:0 to\n 16-bit interleaved RGB conversion when the chroma planes have a\n lower bit depth than luma\n * CVE-2026-XXXXX: Heap buffer overflow in the SVT-AV1 encoder\n plugin when encoding a high-bit-depth alpha channel, and a\n double free on its send-picture error path.\n * CVE-2026-84451: Incomplete fix: the tile range check of the\n unci decoder (without icef) could still overflow, allowing an\n out-of-bounds read\n * CVE-2026-XXXXX: Heap out-of-bounds read when converting odd-\n height 4:2:0 frames of an uncompressed (uncv) image sequence to\n RGB.\n * CVE-2026-XXXXX: Out-of-bounds read in the RGB to YCbCr identity-\n matrix color conversion when the R, G, and B planes have\n different bit depths\n * CVE-2026-84450: A clap property combined with an oversized ispe\n reached an assert() in the Fraction arithmetic and aborted the\n process (incomplete fix). An error is returned instead.\n * Fix Several smaller findings\n * Fix Undefined behavior (negative shift) in the HDR bit-depth\n up-conversion for target bit depths above 16. Such conversions\n are now rejected.\n * A number of bug fixes\n- Update to version 1.23.2: [jsc#PED-16355]\n * CVE-2026-84383: Heap buffer overflow in\n scale_nearest_neighbor() via duplicate alpha planes from\n nested iden/auxl items. (boo#CVE-2026-84383)\n * Out-of-bounds read and write in derived-item and pixel-plane\n handling. Through iden and auxl item chains, a crafted file\n could attach pixel planes whose size differs from the image\n geometry; crop, scale, and plane-extraction code then indexed\n those planes with the wrong size. A working code-execution\n exploit was confirmed. Plane sizes are now validated wherever\n they are consumed. (boo#1279444)\n * CVE-2026-84384: brotli/zlib decompression of mime metadata\n and unci image data had no effective output-size limit, so a\n decompression bomb could exhaust memory. Decompressed output\n is now bounded by the security limits. (boo#1279445)\n * CVE-2026-84447: Chains of derived-image references (grid,\n iovl, iden) bypassed decode caching and memory limits, causing\n CPU and memory amplification. (boo#1279446)\n * CVE-2026-84446: Sequence sample-timing initialization could\n produce non-terminating decode loops and unbounded memory,\n bypassing max_sequence_frames. (boo#1279447)\n * CVE-2026-84444: Out-of-bounds write in the unci encoder when\n heif_context_add_image_tile() is given a tile whose planes do\n not match its declared size. (boo#1279448)\n * CVE-2026-84448: Heap out-of-bounds read in the inline-mask\n region API when mask_data_len does not match the region\n geometry. (boo#1279449)\n * C++ exceptions such as std::bad_alloc can no longer escape the\n C API read/decode entry points; they are returned as a\n heif_error instead of aborting the process\n * assert()s in the pixel-image plane allocation were replaced by\n runtime errors\n * stts/ctts tables describing more samples than the track can\n have are rejected\n * pclr (JPEG 2000 palette) box: the number of palette entries is\n bounded by the box size\n * BitReader::skip_bytes() is now constant time (fixes a fuzzer\n timeout on bogus alignment values)\n * iden items now validate the decoded image size like all other\n items\n * The uncompressed (unci) encoder rejects images without pixel\n planes\n * meta, mini, and moov boxes with size 0 (extending to the end of\n the file) are now parsed correctly\n * Fixed an integer overflow when probing the file size\n * Fixed undefined behavior (signed shift) when reading the NAL\n unit length in the OpenH264 decoder\n * heif_region_item_add_region_inline_mask_data() now requires\n non-zero width and height and the mask_data_len must equal\n the expected (width * height + 7) / 8; otherwise it returns\n an error instead of storing the mask\n * heif_image_add_plane() returns an error instead of aborting\n for bit depths outside 1..128 or interleaved component counts\n outside 1..255\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-Leap-16.0-1716",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/2026/opensuse-su-2026_21889-1.json"
},
{
"category": "self",
"summary": "SUSE Bug 1273083",
"url": "https://bugzilla.suse.com/1273083"
},
{
"category": "self",
"summary": "SUSE Bug 1279443",
"url": "https://bugzilla.suse.com/1279443"
},
{
"category": "self",
"summary": "SUSE Bug 1279444",
"url": "https://bugzilla.suse.com/1279444"
},
{
"category": "self",
"summary": "SUSE Bug 1279445",
"url": "https://bugzilla.suse.com/1279445"
},
{
"category": "self",
"summary": "SUSE Bug 1279446",
"url": "https://bugzilla.suse.com/1279446"
},
{
"category": "self",
"summary": "SUSE Bug 1279447",
"url": "https://bugzilla.suse.com/1279447"
},
{
"category": "self",
"summary": "SUSE Bug 1279448",
"url": "https://bugzilla.suse.com/1279448"
},
{
"category": "self",
"summary": "SUSE Bug 1279449",
"url": "https://bugzilla.suse.com/1279449"
},
{
"category": "self",
"summary": "SUSE Bug 1280001",
"url": "https://bugzilla.suse.com/1280001"
},
{
"category": "self",
"summary": "SUSE Bug 1280002",
"url": "https://bugzilla.suse.com/1280002"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-84383 page",
"url": "https://www.suse.com/security/cve/CVE-2026-84383/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-84384 page",
"url": "https://www.suse.com/security/cve/CVE-2026-84384/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-84444 page",
"url": "https://www.suse.com/security/cve/CVE-2026-84444/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-84446 page",
"url": "https://www.suse.com/security/cve/CVE-2026-84446/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-84447 page",
"url": "https://www.suse.com/security/cve/CVE-2026-84447/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-84448 page",
"url": "https://www.suse.com/security/cve/CVE-2026-84448/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-84450 page",
"url": "https://www.suse.com/security/cve/CVE-2026-84450/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-84451 page",
"url": "https://www.suse.com/security/cve/CVE-2026-84451/"
}
],
"title": "Security update for libheif",
"tracking": {
"current_release_date": "2026-11-15T21:11:52Z",
"generator": {
"date": "2026-09-20T12:44:23Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2026:21889-1",
"initial_release_date": "2026-09-20T12:44:23Z",
"revision_history": [
{
"date": "2026-09-20T12:44:23Z",
"number": "1",
"summary": "Current version"
},
{
"date": "2026-11-15T21:11:52Z",
"number": "2",
"summary": "unknown changes"
}
],
"status": "final",
"version": "2"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.aarch64",
"product": {
"name": "gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.aarch64",
"product_id": "gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.aarch64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:struktur:libheif:1.23.4:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/gdk-pixbuf-loader-libheif@1.23.4-160000.1.1?arch=aarch64\u0026upstream=libheif-0:1.23.4-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libheif-aom-0:1.23.4-160000.1.1.aarch64",
"product": {
"name": "libheif-aom-0:1.23.4-160000.1.1.aarch64",
"product_id": "libheif-aom-0:1.23.4-160000.1.1.aarch64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:struktur:libheif:1.23.4:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libheif-aom@1.23.4-160000.1.1?arch=aarch64\u0026upstream=libheif-0:1.23.4-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libheif-dav1d-0:1.23.4-160000.1.1.aarch64",
"product": {
"name": "libheif-dav1d-0:1.23.4-160000.1.1.aarch64",
"product_id": "libheif-dav1d-0:1.23.4-160000.1.1.aarch64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:struktur:libheif:1.23.4:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libheif-dav1d@1.23.4-160000.1.1?arch=aarch64\u0026upstream=libheif-0:1.23.4-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libheif-devel-0:1.23.4-160000.1.1.aarch64",
"product": {
"name": "libheif-devel-0:1.23.4-160000.1.1.aarch64",
"product_id": "libheif-devel-0:1.23.4-160000.1.1.aarch64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:struktur:libheif:1.23.4:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libheif-devel@1.23.4-160000.1.1?arch=aarch64\u0026upstream=libheif-0:1.23.4-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libheif-ffmpeg-0:1.23.4-160000.1.1.aarch64",
"product": {
"name": "libheif-ffmpeg-0:1.23.4-160000.1.1.aarch64",
"product_id": "libheif-ffmpeg-0:1.23.4-160000.1.1.aarch64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:struktur:libheif:1.23.4:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libheif-ffmpeg@1.23.4-160000.1.1?arch=aarch64\u0026upstream=libheif-0:1.23.4-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libheif-jpeg-0:1.23.4-160000.1.1.aarch64",
"product": {
"name": "libheif-jpeg-0:1.23.4-160000.1.1.aarch64",
"product_id": "libheif-jpeg-0:1.23.4-160000.1.1.aarch64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:struktur:libheif:1.23.4:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libheif-jpeg@1.23.4-160000.1.1?arch=aarch64\u0026upstream=libheif-0:1.23.4-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libheif-openh264-0:1.23.4-160000.1.1.aarch64",
"product": {
"name": "libheif-openh264-0:1.23.4-160000.1.1.aarch64",
"product_id": "libheif-openh264-0:1.23.4-160000.1.1.aarch64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:struktur:libheif:1.23.4:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libheif-openh264@1.23.4-160000.1.1?arch=aarch64\u0026upstream=libheif-0:1.23.4-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libheif-openjpeg-0:1.23.4-160000.1.1.aarch64",
"product": {
"name": "libheif-openjpeg-0:1.23.4-160000.1.1.aarch64",
"product_id": "libheif-openjpeg-0:1.23.4-160000.1.1.aarch64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:struktur:libheif:1.23.4:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libheif-openjpeg@1.23.4-160000.1.1?arch=aarch64\u0026upstream=libheif-0:1.23.4-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libheif-rav1e-0:1.23.4-160000.1.1.aarch64",
"product": {
"name": "libheif-rav1e-0:1.23.4-160000.1.1.aarch64",
"product_id": "libheif-rav1e-0:1.23.4-160000.1.1.aarch64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:struktur:libheif:1.23.4:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libheif-rav1e@1.23.4-160000.1.1?arch=aarch64\u0026upstream=libheif-0:1.23.4-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libheif-svtenc-0:1.23.4-160000.1.1.aarch64",
"product": {
"name": "libheif-svtenc-0:1.23.4-160000.1.1.aarch64",
"product_id": "libheif-svtenc-0:1.23.4-160000.1.1.aarch64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:struktur:libheif:1.23.4:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libheif-svtenc@1.23.4-160000.1.1?arch=aarch64\u0026upstream=libheif-0:1.23.4-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libheif1-0:1.23.4-160000.1.1.aarch64",
"product": {
"name": "libheif1-0:1.23.4-160000.1.1.aarch64",
"product_id": "libheif1-0:1.23.4-160000.1.1.aarch64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:struktur:libheif:1.23.4:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libheif1@1.23.4-160000.1.1?arch=aarch64\u0026upstream=libheif-0:1.23.4-160000.1.1.src.rpm"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.ppc64le",
"product": {
"name": "gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.ppc64le",
"product_id": "gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.ppc64le",
"product_identification_helper": {
"cpe": "cpe:2.3:a:struktur:libheif:1.23.4:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/gdk-pixbuf-loader-libheif@1.23.4-160000.1.1?arch=ppc64le\u0026upstream=libheif-0:1.23.4-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libheif-aom-0:1.23.4-160000.1.1.ppc64le",
"product": {
"name": "libheif-aom-0:1.23.4-160000.1.1.ppc64le",
"product_id": "libheif-aom-0:1.23.4-160000.1.1.ppc64le",
"product_identification_helper": {
"cpe": "cpe:2.3:a:struktur:libheif:1.23.4:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libheif-aom@1.23.4-160000.1.1?arch=ppc64le\u0026upstream=libheif-0:1.23.4-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libheif-dav1d-0:1.23.4-160000.1.1.ppc64le",
"product": {
"name": "libheif-dav1d-0:1.23.4-160000.1.1.ppc64le",
"product_id": "libheif-dav1d-0:1.23.4-160000.1.1.ppc64le",
"product_identification_helper": {
"cpe": "cpe:2.3:a:struktur:libheif:1.23.4:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libheif-dav1d@1.23.4-160000.1.1?arch=ppc64le\u0026upstream=libheif-0:1.23.4-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libheif-devel-0:1.23.4-160000.1.1.ppc64le",
"product": {
"name": "libheif-devel-0:1.23.4-160000.1.1.ppc64le",
"product_id": "libheif-devel-0:1.23.4-160000.1.1.ppc64le",
"product_identification_helper": {
"cpe": "cpe:2.3:a:struktur:libheif:1.23.4:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libheif-devel@1.23.4-160000.1.1?arch=ppc64le\u0026upstream=libheif-0:1.23.4-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libheif-ffmpeg-0:1.23.4-160000.1.1.ppc64le",
"product": {
"name": "libheif-ffmpeg-0:1.23.4-160000.1.1.ppc64le",
"product_id": "libheif-ffmpeg-0:1.23.4-160000.1.1.ppc64le",
"product_identification_helper": {
"cpe": "cpe:2.3:a:struktur:libheif:1.23.4:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libheif-ffmpeg@1.23.4-160000.1.1?arch=ppc64le\u0026upstream=libheif-0:1.23.4-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libheif-jpeg-0:1.23.4-160000.1.1.ppc64le",
"product": {
"name": "libheif-jpeg-0:1.23.4-160000.1.1.ppc64le",
"product_id": "libheif-jpeg-0:1.23.4-160000.1.1.ppc64le",
"product_identification_helper": {
"cpe": "cpe:2.3:a:struktur:libheif:1.23.4:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libheif-jpeg@1.23.4-160000.1.1?arch=ppc64le\u0026upstream=libheif-0:1.23.4-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libheif-openh264-0:1.23.4-160000.1.1.ppc64le",
"product": {
"name": "libheif-openh264-0:1.23.4-160000.1.1.ppc64le",
"product_id": "libheif-openh264-0:1.23.4-160000.1.1.ppc64le",
"product_identification_helper": {
"cpe": "cpe:2.3:a:struktur:libheif:1.23.4:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libheif-openh264@1.23.4-160000.1.1?arch=ppc64le\u0026upstream=libheif-0:1.23.4-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libheif-openjpeg-0:1.23.4-160000.1.1.ppc64le",
"product": {
"name": "libheif-openjpeg-0:1.23.4-160000.1.1.ppc64le",
"product_id": "libheif-openjpeg-0:1.23.4-160000.1.1.ppc64le",
"product_identification_helper": {
"cpe": "cpe:2.3:a:struktur:libheif:1.23.4:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libheif-openjpeg@1.23.4-160000.1.1?arch=ppc64le\u0026upstream=libheif-0:1.23.4-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libheif-rav1e-0:1.23.4-160000.1.1.ppc64le",
"product": {
"name": "libheif-rav1e-0:1.23.4-160000.1.1.ppc64le",
"product_id": "libheif-rav1e-0:1.23.4-160000.1.1.ppc64le",
"product_identification_helper": {
"cpe": "cpe:2.3:a:struktur:libheif:1.23.4:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libheif-rav1e@1.23.4-160000.1.1?arch=ppc64le\u0026upstream=libheif-0:1.23.4-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libheif1-0:1.23.4-160000.1.1.ppc64le",
"product": {
"name": "libheif1-0:1.23.4-160000.1.1.ppc64le",
"product_id": "libheif1-0:1.23.4-160000.1.1.ppc64le",
"product_identification_helper": {
"cpe": "cpe:2.3:a:struktur:libheif:1.23.4:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libheif1@1.23.4-160000.1.1?arch=ppc64le\u0026upstream=libheif-0:1.23.4-160000.1.1.src.rpm"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.s390x",
"product": {
"name": "gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.s390x",
"product_id": "gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.s390x",
"product_identification_helper": {
"cpe": "cpe:2.3:a:struktur:libheif:1.23.4:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/gdk-pixbuf-loader-libheif@1.23.4-160000.1.1?arch=s390x\u0026upstream=libheif-0:1.23.4-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libheif-aom-0:1.23.4-160000.1.1.s390x",
"product": {
"name": "libheif-aom-0:1.23.4-160000.1.1.s390x",
"product_id": "libheif-aom-0:1.23.4-160000.1.1.s390x",
"product_identification_helper": {
"cpe": "cpe:2.3:a:struktur:libheif:1.23.4:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libheif-aom@1.23.4-160000.1.1?arch=s390x\u0026upstream=libheif-0:1.23.4-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libheif-dav1d-0:1.23.4-160000.1.1.s390x",
"product": {
"name": "libheif-dav1d-0:1.23.4-160000.1.1.s390x",
"product_id": "libheif-dav1d-0:1.23.4-160000.1.1.s390x",
"product_identification_helper": {
"cpe": "cpe:2.3:a:struktur:libheif:1.23.4:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libheif-dav1d@1.23.4-160000.1.1?arch=s390x\u0026upstream=libheif-0:1.23.4-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libheif-devel-0:1.23.4-160000.1.1.s390x",
"product": {
"name": "libheif-devel-0:1.23.4-160000.1.1.s390x",
"product_id": "libheif-devel-0:1.23.4-160000.1.1.s390x",
"product_identification_helper": {
"cpe": "cpe:2.3:a:struktur:libheif:1.23.4:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libheif-devel@1.23.4-160000.1.1?arch=s390x\u0026upstream=libheif-0:1.23.4-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libheif-ffmpeg-0:1.23.4-160000.1.1.s390x",
"product": {
"name": "libheif-ffmpeg-0:1.23.4-160000.1.1.s390x",
"product_id": "libheif-ffmpeg-0:1.23.4-160000.1.1.s390x",
"product_identification_helper": {
"cpe": "cpe:2.3:a:struktur:libheif:1.23.4:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libheif-ffmpeg@1.23.4-160000.1.1?arch=s390x\u0026upstream=libheif-0:1.23.4-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libheif-jpeg-0:1.23.4-160000.1.1.s390x",
"product": {
"name": "libheif-jpeg-0:1.23.4-160000.1.1.s390x",
"product_id": "libheif-jpeg-0:1.23.4-160000.1.1.s390x",
"product_identification_helper": {
"cpe": "cpe:2.3:a:struktur:libheif:1.23.4:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libheif-jpeg@1.23.4-160000.1.1?arch=s390x\u0026upstream=libheif-0:1.23.4-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libheif-openh264-0:1.23.4-160000.1.1.s390x",
"product": {
"name": "libheif-openh264-0:1.23.4-160000.1.1.s390x",
"product_id": "libheif-openh264-0:1.23.4-160000.1.1.s390x",
"product_identification_helper": {
"cpe": "cpe:2.3:a:struktur:libheif:1.23.4:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libheif-openh264@1.23.4-160000.1.1?arch=s390x\u0026upstream=libheif-0:1.23.4-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libheif-openjpeg-0:1.23.4-160000.1.1.s390x",
"product": {
"name": "libheif-openjpeg-0:1.23.4-160000.1.1.s390x",
"product_id": "libheif-openjpeg-0:1.23.4-160000.1.1.s390x",
"product_identification_helper": {
"cpe": "cpe:2.3:a:struktur:libheif:1.23.4:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libheif-openjpeg@1.23.4-160000.1.1?arch=s390x\u0026upstream=libheif-0:1.23.4-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libheif-rav1e-0:1.23.4-160000.1.1.s390x",
"product": {
"name": "libheif-rav1e-0:1.23.4-160000.1.1.s390x",
"product_id": "libheif-rav1e-0:1.23.4-160000.1.1.s390x",
"product_identification_helper": {
"cpe": "cpe:2.3:a:struktur:libheif:1.23.4:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libheif-rav1e@1.23.4-160000.1.1?arch=s390x\u0026upstream=libheif-0:1.23.4-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libheif1-0:1.23.4-160000.1.1.s390x",
"product": {
"name": "libheif1-0:1.23.4-160000.1.1.s390x",
"product_id": "libheif1-0:1.23.4-160000.1.1.s390x",
"product_identification_helper": {
"cpe": "cpe:2.3:a:struktur:libheif:1.23.4:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libheif1@1.23.4-160000.1.1?arch=s390x\u0026upstream=libheif-0:1.23.4-160000.1.1.src.rpm"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.x86_64",
"product": {
"name": "gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.x86_64",
"product_id": "gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:struktur:libheif:1.23.4:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/gdk-pixbuf-loader-libheif@1.23.4-160000.1.1?arch=x86_64\u0026upstream=libheif-0:1.23.4-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libheif-aom-0:1.23.4-160000.1.1.x86_64",
"product": {
"name": "libheif-aom-0:1.23.4-160000.1.1.x86_64",
"product_id": "libheif-aom-0:1.23.4-160000.1.1.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:struktur:libheif:1.23.4:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libheif-aom@1.23.4-160000.1.1?arch=x86_64\u0026upstream=libheif-0:1.23.4-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libheif-dav1d-0:1.23.4-160000.1.1.x86_64",
"product": {
"name": "libheif-dav1d-0:1.23.4-160000.1.1.x86_64",
"product_id": "libheif-dav1d-0:1.23.4-160000.1.1.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:struktur:libheif:1.23.4:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libheif-dav1d@1.23.4-160000.1.1?arch=x86_64\u0026upstream=libheif-0:1.23.4-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libheif-devel-0:1.23.4-160000.1.1.x86_64",
"product": {
"name": "libheif-devel-0:1.23.4-160000.1.1.x86_64",
"product_id": "libheif-devel-0:1.23.4-160000.1.1.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:struktur:libheif:1.23.4:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libheif-devel@1.23.4-160000.1.1?arch=x86_64\u0026upstream=libheif-0:1.23.4-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libheif-ffmpeg-0:1.23.4-160000.1.1.x86_64",
"product": {
"name": "libheif-ffmpeg-0:1.23.4-160000.1.1.x86_64",
"product_id": "libheif-ffmpeg-0:1.23.4-160000.1.1.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:struktur:libheif:1.23.4:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libheif-ffmpeg@1.23.4-160000.1.1?arch=x86_64\u0026upstream=libheif-0:1.23.4-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libheif-jpeg-0:1.23.4-160000.1.1.x86_64",
"product": {
"name": "libheif-jpeg-0:1.23.4-160000.1.1.x86_64",
"product_id": "libheif-jpeg-0:1.23.4-160000.1.1.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:struktur:libheif:1.23.4:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libheif-jpeg@1.23.4-160000.1.1?arch=x86_64\u0026upstream=libheif-0:1.23.4-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libheif-openh264-0:1.23.4-160000.1.1.x86_64",
"product": {
"name": "libheif-openh264-0:1.23.4-160000.1.1.x86_64",
"product_id": "libheif-openh264-0:1.23.4-160000.1.1.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:struktur:libheif:1.23.4:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libheif-openh264@1.23.4-160000.1.1?arch=x86_64\u0026upstream=libheif-0:1.23.4-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libheif-openjpeg-0:1.23.4-160000.1.1.x86_64",
"product": {
"name": "libheif-openjpeg-0:1.23.4-160000.1.1.x86_64",
"product_id": "libheif-openjpeg-0:1.23.4-160000.1.1.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:struktur:libheif:1.23.4:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libheif-openjpeg@1.23.4-160000.1.1?arch=x86_64\u0026upstream=libheif-0:1.23.4-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libheif-rav1e-0:1.23.4-160000.1.1.x86_64",
"product": {
"name": "libheif-rav1e-0:1.23.4-160000.1.1.x86_64",
"product_id": "libheif-rav1e-0:1.23.4-160000.1.1.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:struktur:libheif:1.23.4:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libheif-rav1e@1.23.4-160000.1.1?arch=x86_64\u0026upstream=libheif-0:1.23.4-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libheif-svtenc-0:1.23.4-160000.1.1.x86_64",
"product": {
"name": "libheif-svtenc-0:1.23.4-160000.1.1.x86_64",
"product_id": "libheif-svtenc-0:1.23.4-160000.1.1.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:struktur:libheif:1.23.4:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libheif-svtenc@1.23.4-160000.1.1?arch=x86_64\u0026upstream=libheif-0:1.23.4-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libheif1-0:1.23.4-160000.1.1.x86_64",
"product": {
"name": "libheif1-0:1.23.4-160000.1.1.x86_64",
"product_id": "libheif1-0:1.23.4-160000.1.1.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:struktur:libheif:1.23.4:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libheif1@1.23.4-160000.1.1?arch=x86_64\u0026upstream=libheif-0:1.23.4-160000.1.1.src.rpm"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Leap 16.0",
"product": {
"name": "openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0"
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.aarch64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.aarch64"
},
"product_reference": "gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.ppc64le as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.ppc64le"
},
"product_reference": "gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.s390x as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.s390x"
},
"product_reference": "gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.s390x",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.x86_64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.x86_64"
},
"product_reference": "gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libheif-aom-0:1.23.4-160000.1.1.aarch64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.aarch64"
},
"product_reference": "libheif-aom-0:1.23.4-160000.1.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libheif-aom-0:1.23.4-160000.1.1.ppc64le as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.ppc64le"
},
"product_reference": "libheif-aom-0:1.23.4-160000.1.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libheif-aom-0:1.23.4-160000.1.1.s390x as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.s390x"
},
"product_reference": "libheif-aom-0:1.23.4-160000.1.1.s390x",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libheif-aom-0:1.23.4-160000.1.1.x86_64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.x86_64"
},
"product_reference": "libheif-aom-0:1.23.4-160000.1.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libheif-dav1d-0:1.23.4-160000.1.1.aarch64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.aarch64"
},
"product_reference": "libheif-dav1d-0:1.23.4-160000.1.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libheif-dav1d-0:1.23.4-160000.1.1.ppc64le as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.ppc64le"
},
"product_reference": "libheif-dav1d-0:1.23.4-160000.1.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libheif-dav1d-0:1.23.4-160000.1.1.s390x as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.s390x"
},
"product_reference": "libheif-dav1d-0:1.23.4-160000.1.1.s390x",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libheif-dav1d-0:1.23.4-160000.1.1.x86_64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.x86_64"
},
"product_reference": "libheif-dav1d-0:1.23.4-160000.1.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libheif-devel-0:1.23.4-160000.1.1.aarch64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.aarch64"
},
"product_reference": "libheif-devel-0:1.23.4-160000.1.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libheif-devel-0:1.23.4-160000.1.1.ppc64le as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.ppc64le"
},
"product_reference": "libheif-devel-0:1.23.4-160000.1.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libheif-devel-0:1.23.4-160000.1.1.s390x as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.s390x"
},
"product_reference": "libheif-devel-0:1.23.4-160000.1.1.s390x",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libheif-devel-0:1.23.4-160000.1.1.x86_64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.x86_64"
},
"product_reference": "libheif-devel-0:1.23.4-160000.1.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libheif-ffmpeg-0:1.23.4-160000.1.1.aarch64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.aarch64"
},
"product_reference": "libheif-ffmpeg-0:1.23.4-160000.1.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libheif-ffmpeg-0:1.23.4-160000.1.1.ppc64le as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.ppc64le"
},
"product_reference": "libheif-ffmpeg-0:1.23.4-160000.1.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libheif-ffmpeg-0:1.23.4-160000.1.1.s390x as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.s390x"
},
"product_reference": "libheif-ffmpeg-0:1.23.4-160000.1.1.s390x",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libheif-ffmpeg-0:1.23.4-160000.1.1.x86_64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.x86_64"
},
"product_reference": "libheif-ffmpeg-0:1.23.4-160000.1.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libheif-jpeg-0:1.23.4-160000.1.1.aarch64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.aarch64"
},
"product_reference": "libheif-jpeg-0:1.23.4-160000.1.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libheif-jpeg-0:1.23.4-160000.1.1.ppc64le as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.ppc64le"
},
"product_reference": "libheif-jpeg-0:1.23.4-160000.1.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libheif-jpeg-0:1.23.4-160000.1.1.s390x as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.s390x"
},
"product_reference": "libheif-jpeg-0:1.23.4-160000.1.1.s390x",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libheif-jpeg-0:1.23.4-160000.1.1.x86_64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.x86_64"
},
"product_reference": "libheif-jpeg-0:1.23.4-160000.1.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libheif-openh264-0:1.23.4-160000.1.1.aarch64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.aarch64"
},
"product_reference": "libheif-openh264-0:1.23.4-160000.1.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libheif-openh264-0:1.23.4-160000.1.1.ppc64le as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.ppc64le"
},
"product_reference": "libheif-openh264-0:1.23.4-160000.1.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libheif-openh264-0:1.23.4-160000.1.1.s390x as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.s390x"
},
"product_reference": "libheif-openh264-0:1.23.4-160000.1.1.s390x",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libheif-openh264-0:1.23.4-160000.1.1.x86_64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.x86_64"
},
"product_reference": "libheif-openh264-0:1.23.4-160000.1.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libheif-openjpeg-0:1.23.4-160000.1.1.aarch64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.aarch64"
},
"product_reference": "libheif-openjpeg-0:1.23.4-160000.1.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libheif-openjpeg-0:1.23.4-160000.1.1.ppc64le as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.ppc64le"
},
"product_reference": "libheif-openjpeg-0:1.23.4-160000.1.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libheif-openjpeg-0:1.23.4-160000.1.1.s390x as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.s390x"
},
"product_reference": "libheif-openjpeg-0:1.23.4-160000.1.1.s390x",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libheif-openjpeg-0:1.23.4-160000.1.1.x86_64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.x86_64"
},
"product_reference": "libheif-openjpeg-0:1.23.4-160000.1.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libheif-rav1e-0:1.23.4-160000.1.1.aarch64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.aarch64"
},
"product_reference": "libheif-rav1e-0:1.23.4-160000.1.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libheif-rav1e-0:1.23.4-160000.1.1.ppc64le as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.ppc64le"
},
"product_reference": "libheif-rav1e-0:1.23.4-160000.1.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libheif-rav1e-0:1.23.4-160000.1.1.s390x as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.s390x"
},
"product_reference": "libheif-rav1e-0:1.23.4-160000.1.1.s390x",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libheif-rav1e-0:1.23.4-160000.1.1.x86_64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.x86_64"
},
"product_reference": "libheif-rav1e-0:1.23.4-160000.1.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libheif-svtenc-0:1.23.4-160000.1.1.aarch64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libheif-svtenc-0:1.23.4-160000.1.1.aarch64"
},
"product_reference": "libheif-svtenc-0:1.23.4-160000.1.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libheif-svtenc-0:1.23.4-160000.1.1.x86_64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libheif-svtenc-0:1.23.4-160000.1.1.x86_64"
},
"product_reference": "libheif-svtenc-0:1.23.4-160000.1.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libheif1-0:1.23.4-160000.1.1.aarch64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.aarch64"
},
"product_reference": "libheif1-0:1.23.4-160000.1.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libheif1-0:1.23.4-160000.1.1.ppc64le as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.ppc64le"
},
"product_reference": "libheif1-0:1.23.4-160000.1.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libheif1-0:1.23.4-160000.1.1.s390x as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.s390x"
},
"product_reference": "libheif1-0:1.23.4-160000.1.1.s390x",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libheif1-0:1.23.4-160000.1.1.x86_64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.x86_64"
},
"product_reference": "libheif1-0:1.23.4-160000.1.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 16.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-84383",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-84383"
}
],
"notes": [
{
"category": "general",
"text": "libheif is a HEIF and AVIF file format decoder and encoder. From 1.22.0 until 1.23.2, a crafted HEIF, HEIC, or AVIF item graph using nested iden and auxl references can make HeifPixelImage::transfer_channel_from_image_as() append duplicate Alpha planes with different bit depths to m_storage. HeifPixelImage::scale_nearest_neighbor() in libheif/image/pixelimage.cc allocates the destination Alpha plane using the first plane\u0027s 8-bit depth, then iterates a later 10-bit or 12-bit Alpha component and writes uint16_t samples into the same 8-bit allocation. The output geometry controls the overflow extent and the encoded sample values control the data written, allowing a remote file processed by heif_decode_image() to cause a heap out-of-bounds write. This issue is fixed in version 1.23.2.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-svtenc-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-svtenc-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-84383",
"url": "https://www.suse.com/security/cve/CVE-2026-84383"
},
{
"category": "external",
"summary": "SUSE Bug 1279443 for CVE-2026-84383",
"url": "https://bugzilla.suse.com/1279443"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-svtenc-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-svtenc-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-svtenc-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-svtenc-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-20T12:44:23Z",
"details": "important"
}
],
"title": "CVE-2026-84383"
},
{
"cve": "CVE-2026-84384",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-84384"
}
],
"notes": [
{
"category": "general",
"text": "libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.2, crafted HEIF or AVIF mime metadata and unci image data can cause decompress_brotli() and do_inflate() to grow accumulated output without an effective size limit or MemoryHandle accounting. The brotli path has no output bound, while the zlib path checks only a small temporary buffer in a branch that valid streams do not reach, and overlapping icef units can decompress the same payload repeatedly. HeifContext::interpret_heif_file_images() processes multiple compressed metadata items during file opening, allowing a small file to consume unbounded memory and terminate the process. This issue is fixed in version 1.23.2.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-svtenc-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-svtenc-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-84384",
"url": "https://www.suse.com/security/cve/CVE-2026-84384"
},
{
"category": "external",
"summary": "SUSE Bug 1279445 for CVE-2026-84384",
"url": "https://bugzilla.suse.com/1279445"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-svtenc-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-svtenc-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-svtenc-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-svtenc-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-20T12:44:23Z",
"details": "important"
}
],
"title": "CVE-2026-84384"
},
{
"cve": "CVE-2026-84444",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-84444"
}
],
"notes": [
{
"category": "general",
"text": "libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, when WITH_UNCOMPRESSED_CODEC is enabled, heif_context_add_image_tile() accepts an independently constructed tile whose component-plane dimensions do not match the tile geometry established by the prototype image. ImageItem_uncompressed::add_image_tile() passes that tile directly to unc_encoder::encode_tile(), which lacked the check_component_sizes() gate and sizes its output from the configured tile geometry while copying the tile\u0027s actual component-plane dimensions. An oversized component plane can therefore make unc_encoder_component_interleave::encode_tile() copy attacker-controlled data beyond the heap output buffer. This issue is fixed in version 1.23.2.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-svtenc-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-svtenc-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-84444",
"url": "https://www.suse.com/security/cve/CVE-2026-84444"
},
{
"category": "external",
"summary": "SUSE Bug 1279448 for CVE-2026-84444",
"url": "https://bugzilla.suse.com/1279448"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-svtenc-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-svtenc-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-svtenc-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-svtenc-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-20T12:44:23Z",
"details": "important"
}
],
"title": "CVE-2026-84444"
},
{
"cve": "CVE-2026-84446",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-84446"
}
],
"notes": [
{
"category": "general",
"text": "libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, crafted HEIF sequence timing and edit-list data can make Track::init_sample_timing_table() compute a logical m_num_output_samples value that exceeds the uint32_t counters used by Track_Visual::decode_next_image_sample() and Track::get_next_sample_raw_data(). The resulting comparison can never reach the oversized output count, causing non-terminating decode or raw-sample loops and bypassing max_sequence_frames. The same sequence path repeatedly calls Box_stts::get_sample_duration() and allocates Chunk::m_sample_ranges and Track::m_presentation_timeline outside MemoryHandle accounting, allowing severe CPU and memory exhaustion from a small file. This issue is fixed in version 1.23.2.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-svtenc-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-svtenc-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-84446",
"url": "https://www.suse.com/security/cve/CVE-2026-84446"
},
{
"category": "external",
"summary": "SUSE Bug 1279447 for CVE-2026-84446",
"url": "https://bugzilla.suse.com/1279447"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-svtenc-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-svtenc-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-svtenc-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-svtenc-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-20T12:44:23Z",
"details": "important"
}
],
"title": "CVE-2026-84446"
},
{
"cve": "CVE-2026-84447",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-84447"
}
],
"notes": [
{
"category": "general",
"text": "libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.1 and earlier, crafted grid, iovl, and iden reference graphs can repeatedly decode the same base image because processed_ids is copied per branch and ImageItem::decode_image() has no shared operation budget. This vulnerability is fixed in 1.23.2.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-svtenc-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-svtenc-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-84447",
"url": "https://www.suse.com/security/cve/CVE-2026-84447"
},
{
"category": "external",
"summary": "SUSE Bug 1279446 for CVE-2026-84447",
"url": "https://bugzilla.suse.com/1279446"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-svtenc-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-svtenc-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-svtenc-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-svtenc-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-20T12:44:23Z",
"details": "important"
}
],
"title": "CVE-2026-84447"
},
{
"cve": "CVE-2026-84448",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-84448"
}
],
"notes": [
{
"category": "general",
"text": "libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, the public heif_region_item_add_region_inline_mask_data() function in libheif/api/libheif/heif_regions.cc accepts mask_data_len without verifying that it equals the byte count required by width and height. A later heif_region_get_mask_image() call derives the read length from the region geometry, so an undersized stored buffer causes heif_region_get_inline_mask_image() to read beyond the heap allocation and copy adjacent bytes into the returned monochrome mask image. This can disclose heap data or crash an application that constructs region metadata through the writer API, while the file-parsing path is not affected because it validates the canonical mask size. This issue is fixed in version 1.23.2.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-svtenc-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-svtenc-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-84448",
"url": "https://www.suse.com/security/cve/CVE-2026-84448"
},
{
"category": "external",
"summary": "SUSE Bug 1279449 for CVE-2026-84448",
"url": "https://bugzilla.suse.com/1279449"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-svtenc-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-svtenc-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-svtenc-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-svtenc-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-20T12:44:23Z",
"details": "moderate"
}
],
"title": "CVE-2026-84448"
},
{
"cve": "CVE-2026-84450",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-84450"
}
],
"notes": [
{
"category": "general",
"text": "libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.3, a crafted image item containing a clap property and an ispe width or height greater than INT32_MAX + 1 can reach crop calculations through heif_image_handle_get_image_tiling(). Box_clap::left_rounded() or Box_clap::top_rounded() passes the image dimension minus one to Fraction::Fraction(), whose uint32_t constructor uses an assertion as input validation, causing assert-enabled builds to abort. Release builds can instead compute invalid crop geometry, and the tiling API returns dimensions that the normal decode security limits reject. This issue is fixed in version 1.23.3.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-svtenc-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-svtenc-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-84450",
"url": "https://www.suse.com/security/cve/CVE-2026-84450"
},
{
"category": "external",
"summary": "SUSE Bug 1280002 for CVE-2026-84450",
"url": "https://bugzilla.suse.com/1280002"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-svtenc-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-svtenc-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-svtenc-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-svtenc-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-20T12:44:23Z",
"details": "important"
}
],
"title": "CVE-2026-84450"
},
{
"cve": "CVE-2026-84451",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-84451"
}
],
"notes": [
{
"category": "general",
"text": "libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.3, the no-icef full-item branch of unc_decoder::get_compressed_image_data_uncompressed() in libheif/codecs/uncompressed/unc_decoder.cc retains an addition-based range check that can wrap when a crafted uncompressed tile grid produces a large range_start_offset and range_size. The overflow makes the bounds comparison pass and allows heif_image_handle_decode_image_tile() to call memcpy() with an invalid source pointer and a very large length when decoding a valid high-index advertised tile. This incomplete remediation of CVE-2026-62292 can reliably crash tile-processing applications, while whole-image decoding is not claimed to reach the demonstrated path. This issue is fixed in version 1.23.3.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-svtenc-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-svtenc-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-84451",
"url": "https://www.suse.com/security/cve/CVE-2026-84451"
},
{
"category": "external",
"summary": "SUSE Bug 1280001 for CVE-2026-84451",
"url": "https://bugzilla.suse.com/1280001"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-svtenc-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-svtenc-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:gdk-pixbuf-loader-libheif-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-aom-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-dav1d-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-devel-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-ffmpeg-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-jpeg-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-openh264-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-openjpeg-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif-rav1e-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif-svtenc-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif-svtenc-0:1.23.4-160000.1.1.x86_64",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.aarch64",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.s390x",
"openSUSE Leap 16.0:libheif1-0:1.23.4-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-20T12:44:23Z",
"details": "important"
}
],
"title": "CVE-2026-84451"
}
]
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
How durations are calculated
Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.
Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.