Inefficient Algorithmic Complexity in libheif - #VU158758

Vulnerability details

The vulnerability allows a remote attacker to cause a denial of service by exhausting parsing-worker CPU resources.

The vulnerability exists due to inefficient algorithmic complexity in libheif's Box_stsc::get_chunk() when looking up sample-to-chunk entries during file opening. A remote attacker can upload a crafted HEIF file containing N ordered stsc entries and N chunks to trigger a linear table scan for each chunk, producing O(N^2) CPU work and exhausting a parsing worker before any frame request or codec invocation.

The lookup is triggered by any file containing a moov box, regardless of its ftyp brands, including an ordinary still image with an appended moov box.

Affected software

Remediation

External References

• https://github.com/strukturag/libheif/security/advisories/GHSA-74mj-m37q-h3q9
• https://github.com/strukturag/libheif/commit/517dd138

Related Security Bulletins

• Multiple vulnerabilities in libheif