CVE-2026-84446: libheif: Sequence decode timing-table initialization allows non-terminating loops and unbounded memory, bypassing max_sequence_frames
libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, crafted HEIF sequence timing and edit-list data can make Track::initsampletimingtable() compute a logical mnumoutputsamples value that exceeds the uint32t counters used by TrackVisual::decodenextimagesample() and Track::getnextsamplerawdata(). The resulting comparison can never reach the oversized output count, causing non-terminating decode or raw-sample loops and bypassing maxsequenceframes. The same sequence path repeatedly calls Boxstts::getsampleduration() and allocates Chunk::msampleranges and Track::mpresentationtimeline outside MemoryHandle accounting, allowing severe CPU and memory exhaustion from a small file. This issue is fixed in version 1.23.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
libheifto a version that resolves this vulnerability.Fixed in 1.23.2
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications that decode attacker-controlled HEIF or AVIF sequence content using libheif versions before 1.23.2 are exposed. The attack can be delivered over the network and requires no privileges or user interaction.
What does an attacker need to provide to trigger the vulnerability?
An attacker needs a crafted HEIF file containing sequence timing and edit-list data that causes the logical output-sample count to exceed the uint32_t counters used during decoding or raw-sample processing.
Are configured sequence-frame limits sufficient protection?
No. The crafted sequence path can bypass max_sequence_frames, so relying on that limit alone does not prevent the non-terminating loops or unbounded memory allocation.
What is the impact if exploitation succeeds?
Processing a small malicious file can consume severe CPU and memory through non-terminating decode or raw-sample loops and allocations outside MemoryHandle accounting, resulting in denial of service.
What remediation is available?
Upgrade libheif to version 1.23.2, which fixes the issue.