CVE-2026-84446: libheif: Sequence decode timing-table initialization allows non-terminating loops and unbounded memory, bypassing max_sequence_frames

Published Sep 18, 2026
·
Updated

libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, crafted HEIF sequence timing and edit-list data can make Track::initsampletimingtable() compute a logical mnumoutputsamples value that exceeds the uint32t counters used by TrackVisual::decodenextimagesample() and Track::getnextsamplerawdata(). The resulting comparison can never reach the oversized output count, causing non-terminating decode or raw-sample loops and bypassing maxsequenceframes. The same sequence path repeatedly calls Boxstts::getsampleduration() and allocates Chunk::msampleranges and Track::mpresentationtimeline outside MemoryHandle accounting, allowing severe CPU and memory exhaustion from a small file. This issue is fixed in version 1.23.2.

Affected Software

1 affected component
Fraunhofer IIS libheif<1.23.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade libheif to a version that resolves this vulnerability.

    Fixed in 1.23.2

Event History

Sep 18, 2026
CVE Published
via MITRE·03:54 PM
Data Sourced
via MITRE·03:54 PM
DescriptionSeverityWeakness

Frequently Asked Questions

1

Who is exposed to this issue?

Applications that decode attacker-controlled HEIF or AVIF sequence content using libheif versions before 1.23.2 are exposed. The attack can be delivered over the network and requires no privileges or user interaction.

2

What does an attacker need to provide to trigger the vulnerability?

An attacker needs a crafted HEIF file containing sequence timing and edit-list data that causes the logical output-sample count to exceed the uint32_t counters used during decoding or raw-sample processing.

3

Are configured sequence-frame limits sufficient protection?

No. The crafted sequence path can bypass max_sequence_frames, so relying on that limit alone does not prevent the non-terminating loops or unbounded memory allocation.

4

What is the impact if exploitation succeeds?

Processing a small malicious file can consume severe CPU and memory through non-terminating decode or raw-sample loops and allocations outside MemoryHandle accounting, resulting in denial of service.

5

What remediation is available?

Upgrade libheif to version 1.23.2, which fixes the issue.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203