Asymmetric Resource Consumption (Amplification) in libheif - #VU158750
Published: November 3, 2026
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service through CPU exhaustion in applications that decode untrusted HEIF images or image sequences using libheif.
The vulnerability exists due to asymmetric resource consumption in Decoder::decode_sequence_frame_from_compressed_data() when submitting configuration data and image item or sequence sample data to a codec plugin without bounding the number of coded pictures processed. A remote attacker can supply a crafted HEIF image item or sequence sample containing numerous coded pictures to occupy a decoding worker for seconds or minutes while the application receives only one image.
The excessive decoding can occur even when the file's item count, declared image dimensions, and memory usage remain within existing security limits.