RUSTSEC-2026-0456: Panic on an HEVC tile layout that does not match the active SPS

An HEVC picture parameter set (PPS) stores explicit tile column widths and row heights computed against the sequence parameter set (SPS) active when it was parsed. A crafted stream can redefine that SPS afterwards, so that the tile sizes add up to more than the picture. The decoder then indexed past its coding tree block tables: Rust's bounds checks turned this into a panic, or the picture was decoded wrongly. A panic aborts the decoding thread, or the whole process when built with panic = "abort". The crate forbids unsafe code, so there is no memory corruption.

Any application that decodes untrusted HEIC files or HEVC streams with heifer-hevc-dec, directly or through the heifer crate, is affected.

The flaw was corrected in 0.3.27 (commit 71dfc67): a tile layout that does not match the picture size is rejected with Error::Invalid at decode time.