SB2026110339 - Multiple vulnerabilities in libheif

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026110339

SB2026110339 - Multiple vulnerabilities in libheif

Published: November 3, 2026

Security Bulletin ID SB2026110339
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 17
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 94% Low 6%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 17 vulnerabilities.


1) Asymmetric Resource Consumption (Amplification) (CVE-ID: N/A)

CWE-ID: CWE-405 - Asymmetric Resource Consumption (Amplification)

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service through CPU exhaustion in applications that decode untrusted HEIF images or image sequences using libheif.

The vulnerability exists due to asymmetric resource consumption in Decoder::decode_sequence_frame_from_compressed_data() when submitting configuration data and image item or sequence sample data to a codec plugin without bounding the number of coded pictures processed. A remote attacker can supply a crafted HEIF image item or sequence sample containing numerous coded pictures to occupy a decoding worker for seconds or minutes while the application receives only one image.

The excessive decoding can occur even when the file's item count, declared image dimensions, and memory usage remain within existing security limits.


2) Inefficient Algorithmic Complexity (CVE-ID: N/A)

CWE-ID: CWE-407 - Inefficient Algorithmic Complexity

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service by exhausting parsing-worker CPU resources.

The vulnerability exists due to inefficient algorithmic complexity in libheif's Box_stsc::get_chunk() when looking up sample-to-chunk entries during file opening. A remote attacker can upload a crafted HEIF file containing N ordered stsc entries and N chunks to trigger a linear table scan for each chunk, producing O(N^2) CPU work and exhausting a parsing worker before any frame request or codec invocation.

The lookup is triggered by any file containing a moov box, regardless of its ftyp brands, including an ordinary still image with an appended moov box.


3) Interpretation Conflict (CVE-ID: N/A)

CWE-ID: CWE-436 - Interpretation Conflict

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service through excessive memory allocation.

The vulnerability exists due to an interpretation conflict between libheif's AV1 coded-size scanner and the libaom decoder when processing AVIF files containing an OBU header without a size field. A remote attacker can supply a crafted AVIF file that declares small image dimensions but contains a larger picture after the unsized OBU, bypassing the pre-decode coded-size limits and causing excessive memory allocation during decoding.


4) Interpretation Conflict (CVE-ID: N/A)

CWE-ID: CWE-436 - Interpretation Conflict

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service through excessive memory allocation.

The vulnerability exists due to inconsistent interpretation of AV1 UVLC codes and ignored parsing failures in libheif's AV1 coded-size scanner when processing crafted AVIF files. A remote attacker can supply a file with a long UVLC code that causes the scanner to skip the sequence header or read a small decoy size, bypassing the coded-size check and causing excessive memory allocation when the libaom backend decodes the actual large frame.


5) Out-of-bounds read (CVE-ID: N/A)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose process memory through decoded images or cause a denial of service.

The vulnerability exists due to an out-of-bounds read in libheif's OpenH264 decoding path when processing an AVC-coded HEIF file containing an SPS that the coded-size scanner cannot parse. A remote attacker can supply a specially crafted file with cropping offsets that overflow a signed 32-bit check, causing rejected SPS data to reach OpenH264 and the plugin to copy from image-plane pointers outside the decoded frame buffer, to disclose process memory or crash the application.


6) Heap-based buffer overflow (CVE-ID: N/A)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service by triggering heap corruption and a process crash.

The vulnerability exists due to a heap-based buffer overflow in libheif's HeifPixelImage::extend_padding_to_size() when a requested padding size increases one dimension but decreases the other. The function allocates a plane using the requested dimensions but copies the original plane's full rows, writing beyond the allocation. A remote attacker can supply a crafted mixed-size image sequence to an application that re-encodes its frames using the x265 HEVC or x264 AVC sequence encoder to cause a denial of service.


7) Use-after-free (CVE-ID: N/A)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service in applications that decode untrusted HEIF images.

The vulnerability exists due to a heap use-after-free in libheif's derived-image bit-depth queries when decoding grid tiles in parallel. A remote attacker can submit a crafted HEIF image containing derived tiles that share a coded input, causing one thread to access cached decoder data freed by another thread, to crash an image-processing service and deny service.

The vulnerable path executes before codec plugin selection, so exploitation does not require an OpenJPEG decoder plugin.


8) Inefficient Algorithmic Complexity (CVE-ID: N/A)

CWE-ID: CWE-407 - Inefficient Algorithmic Complexity

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service through CPU exhaustion in image-processing tools distributed with libheif.

The vulnerability exists due to inefficient algorithmic complexity in the heifio helper's find_exif_tag_in_ifd() function when traversing ExifIFD pointers without limiting total entry reads or repeated visits to the same IFD. A remote attacker can supply a crafted HEIC or AVIF file to heif-thumbnailer or heif-dec, or a crafted JPEG or PNG file to heif-enc, containing many self-referencing ExifIFD entries to trigger excessive traversal and exhaust CPU resources.

Applications that use only the libheif library, including the gdk-pixbuf loader, do not execute the affected code path.


9) Excessive Iteration (CVE-ID: N/A)

CWE-ID: CWE-834 - Excessive Iteration

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service through CPU exhaustion in applications that decode untrusted HEIF images.

The vulnerability exists due to excessive iteration in libheif's ImageItem::decode_image() when processing repeated image transformation associations. A remote attacker can supply a crafted HEIF file containing repeated irot, imir, or clap associations to trigger repeated full-image transformations and exhaust a decoding worker's CPU resources.


10) Access of Uninitialized Pointer (CVE-ID: N/A)

CWE-ID: CWE-824 - Access of Uninitialized Pointer

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service by crashing the heif-info or heif-dec command-line tool.

The vulnerability exists due to access of an uninitialized pointer in the URI track-listing code of heif-info and heif-dec when processing a HEIF sequence containing a 'urim' sample entry without a 'uri ' child box. A remote attacker can trick a victim into processing a crafted file with heif-info or heif-dec -S to trigger printing and releasing an uninitialized URI pointer, potentially causing a use-after-free and double free, and crash the tool.

The libheif library itself is not affected.


11) Access of Uninitialized Pointer (CVE-ID: N/A)

CWE-ID: CWE-824 - Access of Uninitialized Pointer

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to failure to initialize the output image handle in libheif's heif_context_encode_thumbnail() function when encoding an image whose dimensions fit within the requested thumbnail bounding box. A remote attacker can supply such an image to a service that generates thumbnails during encoding to trigger access to an uninitialized or stale pointer, potentially causing a use-after-free, double free, invalid free, or process crash.


12) Excessive Iteration (CVE-ID: N/A)

CWE-ID: CWE-834 - Excessive Iteration

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service through excessive CPU consumption during image-sequence decoding.

The vulnerability exists due to excessive iteration in libheif's image-sequence decoding logic when ignore_sequence_editlist is enabled but the repetition-expanded sample count is used instead of the original sample count. A remote attacker can supply a crafted HEIF sequence containing a real picture followed by picture-less samples to trigger excessive sample submissions across decoding calls and exhaust CPU resources.


13) Excessive Iteration (CVE-ID: N/A)

CWE-ID: CWE-834 - Excessive Iteration

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service through CPU exhaustion of an image-sequence decoding process or worker.

The vulnerability exists due to excessive iteration in libheif's heif_track_decode_next_image() function when processing repeating image sequences whose samples produce no decoded image. A remote attacker can supply a crafted HEIF sequence with a repeating edit list and a picture-less sample accepted by the decoder to keep a single decoding call submitting samples repeatedly, exhausting CPU resources.

The demonstrated decoder is libde265 for HEVC; other decoder plugins are affected only if they accept a nonempty sample without producing an image.


14) Inefficient Algorithmic Complexity (CVE-ID: N/A)

CWE-ID: CWE-407 - Inefficient Algorithmic Complexity

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service through excessive CPU consumption.

The vulnerability exists due to inefficient algorithmic complexity in libheif's color-profile association handling when opening HEIF files. A remote attacker can supply a crafted HEIF file whose color-profile associations trigger repeated property creation, serialization, copying, and duplicate comparisons to exhaust CPU resources before image selection or decoding.


15) Deadlock (CVE-ID: N/A)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service by indefinitely blocking image decoding.

The vulnerability exists due to incorrect handling of unfilled tile queue entries in libheif's ImageItem_Grid::decode_full_grid_image() when decoding grid images in parallel with non-strict decoding options. A remote attacker can supply a crafted HEIF file containing skipped tiles and an unreferenced item 0 with cyclic alpha-image references to trigger unintended decoding of that item, causing worker threads to acquire image decode mutexes in opposite orders and deadlock.

The hang requires at least two tile-decoding threads.


16) Asymmetric Resource Consumption (Amplification) (CVE-ID: N/A)

CWE-ID: CWE-405 - Asymmetric Resource Consumption (Amplification)

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service through CPU exhaustion in applications that decode untrusted HEIF files using libheif.

The vulnerability exists due to asymmetric resource consumption in libheif's derived-image decoding when processing crafted HEIF files that repeatedly decode large images while retaining little or none of their output. A remote attacker can supply a small HEIF file that causes repeated construction or decoding of large images within the item-decode count limit to exhaust CPU resources.

Decoding can succeed and return a small, correct image despite the excessive CPU consumption.


17) Access of Uninitialized Pointer (CVE-ID: N/A)

CWE-ID: CWE-824 - Access of Uninitialized Pointer

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service and, under restricted conditions, expose attacker-selected memory or trigger an invalid free.

The vulnerability exists due to access of an uninitialized pointer in the libheif gdk-pixbuf loader's stop_load() function when image scaling fails and its return value is ignored. A remote attacker can trick a victim into loading a crafted HEIF/AVIF file at a fixed width or height while preserving its aspect ratio, causing an oversized scaling allocation to fail and the loader to read through and subsequently free an uninitialized image pointer.

Memory exposure and invalid-free effects were demonstrated only with address randomization disabled; with ASLR enabled, only an application crash was demonstrated.


Remediation

Install update from vendor's website.

References