Incomplete Filtering of Special Elements in libheif - #VU153965
Published: October 8, 2026
Vulnerability details
The vulnerability allows a remote attacker to bypass pre-decode resource-limit checks and pass pathological JPEG 2000 geometry to the external decoder.
The vulnerability exists due to incomplete filtering of absolute image coordinates in openjpeg_decode_next_image2() in libheif/plugins/decoder_openjpeg.cc when processing JPEG 2000 image headers. A remote attacker can supply a crafted J2KI HEIF file containing extremely large absolute coordinates but a small canvas span to bypass pre-decode resource-limit checks and pass pathological JPEG 2000 geometry to the external decoder.
The OpenJPEG decoder must be enabled. The issue is reproducible with default global security limits. Downstream memory-safety consequences depend on the OpenJPEG dependency.