Inefficient Algorithmic Complexity in libheif - #VU158746
Published: November 3, 2026
Vulnerability identifier: #VU158746
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-407
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service through excessive CPU consumption.
The vulnerability exists due to inefficient algorithmic complexity in libheif's color-profile association handling when opening HEIF files. A remote attacker can supply a crafted HEIF file whose color-profile associations trigger repeated property creation, serialization, copying, and duplicate comparisons to exhaust CPU resources before image selection or decoding.
Affected software
libheif
Remediation
Install security update from vendor's website.
libheif - update to 1.23.7