GHSA-rmc9-8qp4-gjhx: Panic on chroma QP offsets enabled with an empty offset list

Q: Who is exposed to this issue?

Applications that decode untrusted HEIC files or HEVC streams using heifer-hevc-dec, either directly or through the heifer crate, are affected.

Q: What must an attacker provide to trigger the failure?

An attacker must cause the application to decode a crafted HEVC Range Extensions stream that enables cu_chroma_qp_offset_enabled_flag while the associated picture parameter set has an empty chroma QP offset list. User interaction is required to process the malicious file or stream.

Q: What is the impact of successful exploitation?

The decoder performs an out-of-range list access and panics, aborting the decoding thread. Builds configured with panic = "abort" can terminate the entire process; the issue does not cause memory corruption.

Q: Which version fixes the issue?

The issue was corrected in heifer-hevc-dec version 0.3.27. The fix treats an empty chroma QP offset list as having an offset of zero.

Published Nov 4, 2026

Updated

An HEVC Range Extensions stream can set cuchromaqpoffsetenabledflag in a slice while its picture parameter set carries an empty chroma QP offset list. The decoder then read the list at the signalled index, which panicked on the out-of-range access. A panic aborts the decoding thread, or the whole process when built with panic = "abort". The crate forbids unsafe code, so there is no memory corruption.

Any application that decodes untrusted HEIC files or HEVC streams with heifer-hevc-dec, directly or through the heifer crate, is affected.

The flaw was corrected in 0.3.27 (commit 1a8426e): with an empty list there is no offset to apply, and the offset is zero.

Affected Software

1 affected componentFixes available

rust/heifer-hevc-dec>=0.0.0-0<0.3.27

0.3.27

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade rust/heifer-hevc-dec to a version that resolves this vulnerability.
Fixed in 0.3.27
Upgrade
Upgrade heifer-hevc-dec to a version that resolves this vulnerability.
Fixed in 0.3.27

Event History

Nov 4, 2026

Advisory Published

via OSV·12:00 PM

Data Sourced

via OSV·12:00 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who is exposed to this issue?

Applications that decode untrusted HEIC files or HEVC streams using heifer-hevc-dec, either directly or through the heifer crate, are affected.

What must an attacker provide to trigger the failure?

An attacker must cause the application to decode a crafted HEVC Range Extensions stream that enables cu_chroma_qp_offset_enabled_flag while the associated picture parameter set has an empty chroma QP offset list. User interaction is required to process the malicious file or stream.

What is the impact of successful exploitation?

The decoder performs an out-of-range list access and panics, aborting the decoding thread. Builds configured with panic = "abort" can terminate the entire process; the issue does not cause memory corruption.

Which version fixes the issue?

The issue was corrected in heifer-hevc-dec version 0.3.27. The fix treats an empty chroma QP offset list as having an offset of zero.

GHSA-rmc9-8qp4-gjhx: Panic on chroma QP offsets enabled with an empty offset list

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What must an attacker provide to trigger the failure?

What is the impact of successful exploitation?

Which version fixes the issue?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What must an attacker provide to trigger the failure?

What is the impact of successful exploitation?

Which version fixes the issue?