CVE-2026-84450

Name of the Vulnerable Software and Affected Versions libheif versions 1.19.0 through 1.23.2

Description A crafted image item containing a clap property and an ispe width or height greater than INT32 MAX + 1 can reach crop calculations through the heif image handle get image tiling() function. The Box clap::left rounded() or Box clap::top rounded() functions pass the image dimension minus one to Fraction::Fraction(), where the uint32 t constructor uses an assertion for input validation. This causes builds with assertions enabled to abort. In release builds, this can lead to the computation of invalid crop geometry, resulting in the tiling API returning dimensions that are rejected by normal decode security limits. Additionally, an incomplete fix in version 1.23.1 may leave the software vulnerable to an out-of-bounds read.

Recommendations Update to version 1.23.3 or later.