Inefficient Algorithmic Complexity in libheif - #VU153985
Published: October 8, 2026
Vulnerability identifier: #VU153985
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-407
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to trigger excessive CPU consumption.
The vulnerability exists due to inefficient algorithmic complexity in the unci decoding path, including unc_decoder_pixel_interleave::get_tile_data_sizes, when processing HEIF files with excessively large declared image dimensions. A remote attacker can submit a specially crafted unci-coded HEIF file to trigger excessive CPU consumption.
The issue was reproduced with experimental features enabled and default security limits.
Affected software
libheif
Remediation
Install security update from vendor's website.
libheif - update to 1.23.6