SB2026090827 - Multiple vulnerabilities in libheif

Main Vulnerability Database SB2026090827

SB2026090827 - Multiple vulnerabilities in libheif

Published: September 8, 2026

Security Bulletin ID SB2026090827

CSH Severity

Medium

Patch available

YES

Number of vulnerabilities 8

Exploitation vector Remote access

Highest impact Denial of service

Breakdown by Severity

Low
Medium
High
Critical

Description

This security bulletin contains information about 8 vulnerabilities.

1) Out-of-bounds read (CVE-ID: N/A)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the WebCodecs decoder plugin when processing a crafted HEIF file. A remote attacker can trick the victim into opening a crafted HEIF file to disclose sensitive information.

Only emscripten and wasm builds with the experimental WebCodecs plugin enabled and selected for HEVC decoding are affected.

2) Memory leak (CVE-ID: N/A)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to missing release of memory after effective lifetime in Track::get_next_sample_raw_data() when processing crafted HEIF sequence files with malformed auxiliary metadata. A remote attacker can supply a crafted file to cause a denial of service.

User interaction is required to process a crafted file.

3) Uncaught Exception (CVE-ID: N/A)

CWE-ID: CWE-248 - Uncaught Exception

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an uncaught exception in heif_track_get_next_raw_sequence_sample() when processing a crafted HEIF sequence file containing an attacker-sized sample under memory pressure. A remote attacker can supply a crafted file to cause a denial of service.

User interaction is required to process a crafted file, and exploitation requires an allocation failure.

4) Allocation of Resources Without Limits or Throttling (CVE-ID: N/A)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper enforcement of resource limits in Box_iinf::parse and Box::read_children when parsing an iinf box with a declared item count. A remote attacker can submit a specially crafted HEIF file to cause a denial of service.

Processing an excessive number of items can consume substantial CPU time and heap memory before image decoding.

5) Allocation of Resources Without Limits or Throttling (CVE-ID: N/A)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper enforcement of resource limits in the Emscripten item-ID helper functions when processing a crafted HEIF file with an excessive number of items. A remote attacker can submit a specially crafted HEIF file to cause a denial of service.

The issue affects non-standalone Emscripten builds, where an item count controls a stack allocation that can leave the WebAssembly instance unusable.

6) Uncontrolled Recursion (CVE-ID: N/A)

CWE-ID: CWE-674 - Uncontrolled Recursion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled recursion in HeifFile::check_for_ref_cycle_recursion when parsing a crafted HEIF or AVIF file. A remote attacker can provide a file containing a long chain of image references to cause a denial of service.

The flaw is triggered during parsing before image decoding.

7) Deadlock (CVE-ID: N/A)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a lock-order inversion in the parallel grid tile decoding path when decoding a crafted HEIF grid file with mutually referenced alpha auxiliary images. A remote attacker can submit a specially crafted HEIF file to cause a denial of service.

Once both tile decoding workers have been dispatched, cancellation is no longer polled.

8) Out-of-bounds read (CVE-ID: N/A)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the AOM and x265 encoder plugins when encoding a crafted YCbCr image with differing luma and chroma bit depths. A remote attacker can submit a crafted HEIF file for encoding to disclose sensitive information.

Only builds with a source codec that produces unequal per-channel bit depths and the AOM or x265 encoder plugin are affected.

Remediation

Install update from vendor's website.

References