安全预警@hatschannel | 三向月的日常互联网搬💩集散地BGP 分频: @bakanetwork内频：https://t.me/+KeNZttiOmFtlZjE1「愿你在未来与我的既往重逢」https://timeline.byteloid.onelibheif 被曝 CVSS 9.8 分高危漏洞 (CVE-2026-84383), 解析精心构建的畸形 HEIC/HEIF/AVIF 图片时会触发远程 RCE目前已披露并确定 Next.js / Sharp / ImageMagick 均受此漏洞影响，其他使用 libheif 的程序也仍有可能受此影响请立即升级到：- libheif >= 1.23.2- sharp >= 0.35.4- next.js >= 15.5.24 OR >= 16.3.3src: GHSA#安全预警@hatschannelhttps://timeline.byteloid.one/posts/4040https://timeline.byteloid.one/posts/4040Fri, 11 Sep 2026 15:10:46 GMTlibheif 被曝 CVSS 9.8 分高危漏洞 (CVE-2026-84383), 解析精心构建的畸形 HEIC/HEIF/AVIF 图片时<b><u>会触发远程 RCE</u></b><br /><br />目前已披露并确定 Next.js / Sharp / ImageMagick 均受此漏洞影响，其他使用 libheif 的程序也仍有可能受此影响<br /><br />请立即升级到：<br /><br />- libheif &gt;= 1.23.2<br />- sharp &gt;= 0.35.4<br />- next.js &gt;= 15.5.24 OR &gt;= 16.3.3<br /><br />src: <a href="https://github.com/strukturag/libheif/security/advisories/GHSA-g89c-p67h-r497" target="_blank">GHSA</a><br /><br /><a href="/search/%23%E5%AE%89%E5%85%A8%E9%A2%84%E8%AD%A6%40hatschannel">#安全预警@hatschannel</a><a href="https://github.com/strukturag/libheif/security/advisories/GHSA-g89c-p67h-r497" target="_blank"> <div>GitHub</div> <img class="link_preview_image" alt="Heap buffer overflow in `scale_nearest_neighbor()` via duplicate Alpha planes from nested `iden`/`auxl` items" src="https://cdn4.telesco.pe/file/eji-h6MBLoZECrEfPHR9oRWOpJLhHuBDSxbbDSaYwTEhoo7aVmyvbtobVb8mNdGUa55qs8pnodaAyj5IKSEJ5ILklgIMJpj_oh9HvW8-z4TnDK1KZWaePweJjSKSFvERF575XMB48qMK-8qDu1unen8QDO0G_k8K8TrHaWvdZMyGsmNCEZ0mO1NnNo7wg9vq5NoVnR5FVV76R2SJHzm2iW5xfUxL7ZxgVT6CxCFkxrtg8nH0VAwkNZR7s-ON5ULNUvDmqWtp6VZQDf7tv4zi1IdbqAy_suAxJy85e9rGotYu8mPZRb9drdImQl7BZtfPiAyCk5csJeGS9bxdFDy8Iw.jpg" loading="lazy" /> <div>Heap buffer overflow in `scale_nearest_neighbor()` via duplicate Alpha planes from nested `iden`/`auxl` items</div> <div>### Summary <br />A crafted HEIC/HEIF/AVIF file with nested identity-derivation (`iden`) and auxiliary (`auxl`) item references causes `HeifPixelImage::scale_nearest_neighbor()` to write 16-bit samples ...</div> </a>