This page tracks the Ubuntu fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-84449 →

UBUNTU-CVE-2026-84449

libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.19.6, Op_RGB24_32_to_YCbCr::convert_colorspace() stores image-plane strides in...

Original description

The description as published by the source.

libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.19.6, Op_RGB24_32_to_YCbCr::convert_colorspace() stores image-plane strides in an integer width that can overflow for extremely large RGB images created through heif_image_create() and heif_image_add_plane(). The resulting wrapped stride causes the conversion loop in libheif/color-conversion/rgb2yuv.cc to compute an invalid input pointer and read beyond the allocated interleaved plane while heif_context_encode_image() performs RGB-to-YCbCr conversion. This can crash the encoding process. This issue is fixed in version 1.19.6.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Ubuntu:Pro:18.04:LTS libheif

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-2ubuntu0.1~esm5"}]}]

Ubuntu:Pro:20.04:LTS libheif

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-1ubuntu0.1~esm5"}]}]

Ubuntu:Pro:22.04:LTS libheif

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.0-2ubuntu0.1~esm5"}]}]

Ubuntu:24.04:LTS libheif

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.6-1ubuntu4.9"}]}]

References

advisory ubuntu.com
report ubuntu.com
report cve.org
report github.com
report github.com
report github.com