CVE-2026-32739: libheif is Vulnerable to Infinite Loop DoS via stts Sample Duration Lookup
Last updated 19 June 2026
Other sources
libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and below, a crafted 800-byte HEIF sequence file causes an infinite loop in Boxstts::getsampleduration(), consuming 100% CPU indefinitely with zero progress, leading to DoS. The loop has no iteration limit or timeout and is triggered during file open (parsing) - before any user interaction or image decoding. The process stays alive (no crash, no error logged), making it invisible to crash-based monitoring. This issue has been fixed in version 1.22.0.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
libheifto a version that resolves this vulnerability.Fixed in 1.22.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-32739?
CVE-2026-32739 is a moderate severity vulnerability that can lead to a denial-of-service condition through high CPU consumption.
How do I fix CVE-2026-32739?
To remediate CVE-2026-32739, update libheif to version 1.22.0 or later, as this version includes the necessary fixes.
What versions of libheif are affected by CVE-2026-32739?
CVE-2026-32739 affects libheif versions 1.21.2 and below.
What is the potential impact of CVE-2026-32739?
The potential impact of CVE-2026-32739 is an infinite loop denial-of-service, causing 100% CPU usage.
How does CVE-2026-32739 exploit the libheif library?
CVE-2026-32739 exploits the libheif library through a crafted HEIF file that triggers an infinite loop in the sample duration lookup.