CVE-2026-32739

Description

libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and below, a crafted 800-byte HEIF sequence file causes an infinite loop in Box_stts::get_sample_duration(), consuming 100% CPU indefinitely with zero progress, leading to DoS. The loop has no iteration limit or timeout and is triggered during file open (parsing) - before any user interaction or image decoding. The process stays alive (no crash, no error logged), making it invisible to crash-based monitoring. This issue has been fixed in version 1.22.0.

Traduire en français

Produits concernés

• strukturag libheif
• Struktur libheif

Scores CVSS

Faiblesses (CWE)

• CWE-835

Références

• https://github.com/strukturag/libheif/releases/tag/v1.22.0 Release Notes
• https://github.com/strukturag/libheif/security/advisories/GHSA-j9g7-q9hv-gq8c ExploitVendor Advisory
• https://github.com/strukturag/libheif/security/advisories/GHSA-j9g7-q9hv-gq8c ExploitVendor Advisory

Ailleurs

• NVD
• CVE.org
• CIRCL Vulnerability-Lookup
• CERT-FR
• GitHub Advisories