CVE-2026-50142: libheif: unbounded heap allocation in HEIF sequence parser (stsz fixed-size mode missing bound check)
Last updated 10 July 2026
Other sources
libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.0, a crafted HEIF sequence accepted by heifcontextreadfrommemory() with the msf1 sequence brand can cause unbounded heap allocation. In libheif/sequences/seqboxes.cc, Boxstsz::parse() applies maxsequenceframes only to variable-size samples, so fixed-size mode accepts an attacker-controlled samplecount without a bound. In libheif/sequences/track.cc, Track::load() also adds currentsampleidx and samplesperchunk in 32-bit arithmetic, allowing the consistency check to be bypassed by wraparound. The resulting values reach the Chunk::Chunk() allocation path, which can consume gigabytes of memory and crash or stall the process through memory exhaustion. This issue is fixed in version 1.23.0.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/libheifto a version that resolves this vulnerability.Fixed in 1.23.1-1 - Upgrade
Upgrade
libheifto a version that resolves this vulnerability.Fixed in 1.23.0
Event History
Frequently Asked Questions
Which applications are realistically exposed?
Applications that call heif_context_read_from_memory() on attacker-controlled HEIF data are exposed when the input uses the msf1 sequence brand. The vulnerable behavior can consume gigabytes of memory, causing the process to stall or crash through memory exhaustion.
What does an attacker need to exploit this issue?
An attacker only needs to provide a crafted HEIF sequence; no authentication, user interaction, or special configuration is indicated. The affected parser accepts an attacker-controlled sample_count in fixed-size mode without applying the sequence-frame limit.
What version should be deployed to remediate the vulnerability?
Update libheif to version 1.23.0, which fixes the issue. The affected version range is 1.19.0 through versions before 1.23.0.