RUSTSEC-2026-0460: Panic on chroma QP offsets enabled with an empty offset list
An HEVC Range Extensions stream can set cuchromaqpoffsetenabledflag in a slice while its picture parameter set carries an empty chroma QP offset list. The decoder then read the list at the signalled index, which panicked on the out-of-range access. A panic aborts the decoding thread, or the whole process when built with panic = "abort". The crate forbids unsafe code, so there is no memory corruption.
Any application that decodes untrusted HEIC files or HEVC streams with heifer-hevc-dec, directly or through the heifer crate, is affected.
The flaw was corrected in 0.3.27 (commit 1a8426e): with an empty list there is no offset to apply, and the offset is zero.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rust/heifer-hevc-decto a version that resolves this vulnerability.Fixed in 0.3.27 - Upgrade
Upgrade
heifer-hevc-decto a version that resolves this vulnerability.Fixed in 0.3.27
Event History
Frequently Asked Questions
What input is required to trigger the denial of service?
An attacker needs to supply a crafted HEVC Range Extensions stream, or an HEIC file containing one, that enables cu_chroma_qp_offset_enabled_flag while the picture parameter set has an empty chroma QP offset list. No authentication or prior access is required, but the application must decode the attacker-controlled content.
Which deployments are exposed?
Applications that decode untrusted HEIC files or HEVC streams using heifer-hevc-dec are affected, including applications that use it through the heifer crate. The impact is a decoding-thread panic, or whole-process termination when built with panic = "abort".
Is memory corruption possible?
No. The crate forbids unsafe code, and the reported behavior is an out-of-range access that causes a panic rather than memory corruption.
What version contains the fix?
The issue was corrected in heifer-hevc-dec 0.3.27. The fix treats an empty chroma QP offset list as having no offset to apply, using zero instead.