Excessive Iteration in libheif - #VU158747

Vulnerability details

The vulnerability allows a remote attacker to cause a denial of service through CPU exhaustion of an image-sequence decoding process or worker.

The vulnerability exists due to excessive iteration in libheif's heif_track_decode_next_image() function when processing repeating image sequences whose samples produce no decoded image. A remote attacker can supply a crafted HEIF sequence with a repeating edit list and a picture-less sample accepted by the decoder to keep a single decoding call submitting samples repeatedly, exhausting CPU resources.

The demonstrated decoder is libde265 for HEVC; other decoder plugins are affected only if they accept a nonempty sample without producing an image.

Affected software

Remediation

External References

• https://github.com/strukturag/libheif/security/advisories/GHSA-73j7-gvm9-x8q6
• https://github.com/strukturag/libheif/commit/ea536da34ea423ed4daa47fac0801bc6b93a00ad

Related Security Bulletins

• Multiple vulnerabilities in libheif