Unbounded Heap Allocation in libheif Affects AVIF and HEIF File Decoders

CVE-2026-50142

What is CVE-2026-50142?

The libheif library, responsible for decoding and encoding HEIF and AVIF file formats, contains a vulnerability that allows for unbounded heap allocation. When using heif_context_read_from_memory() with a crafted HEIF sequence, specifically with the msf1 sequence brand, an attacker can manipulate the sample_count, leading to excessive memory consumption during processing. This vulnerability arises as the Box_stsz::parse() method applies constraints only to variable-size samples, inadvertently accepting a manipulated input for fixed-size samples. Additionally, the Track::load() method uses 32-bit arithmetic, permitting wraparound during calculations that can bypass critical consistency checks. Consequently, this can lead to significant memory exhaustion, crashing or stalling the application. The issue was addressed and resolved in version 1.23.0 of the library.

References