Executive brief
libheif is a library for decoding and encoding HEIF and AVIF image files. Crafted HEIF files with malicious sequence timing and edit-list data can cause the decoder to enter non-terminating loops and allocate unbounded memory, allowing an attacker to exhaust CPU and memory resources from a small file. This vulnerability can be triggered by simply opening a malicious file in any application using the affected library.
Technical details
The vulnerability exists in Track::init_sample_timing_table(), which computes a logical m_num_output_samples value as a uint64 that can exceed uint32_t limits, but decode/raw-output loops use uint32 counters that can never reach the oversized count, causing non-terminating loops. Additionally, Box_stts::get_sample_duration() performs O(entries×samples) scans, and Chunk::m_sample_ranges and Track::m_presentation_timeline are allocated outside MemoryHandle accounting, allowing severe CPU and memory exhaustion. The attack vector is network/adjacent via opening a malicious HEIF/AVIF file; no authentication or user interaction beyond file opening is required.
Affected products
- strukturag libheif before 1.23.2
Timeline
- 2026-09-18: disclosed: CVE-2026-84446 published
- 2026-08-25: patched: Fixed in libheif 1.23.2