Memory Exhaustion Vulnerability in libheif HEIF File Format Decoder

CVE-2026-84446

What is CVE-2026-84446?

The libheif library, used for decoding and encoding HEIF and AVIF file formats, is susceptible to a memory exhaustion issue prior to version 1.23.2. This vulnerability arises from crafted HEIF sequence timing and edit-list data, which can trigger a malfunction in the Track::init_sample_timing_table() function. This malfunction may lead to a logical m_num_output_samples value surpassing the limits of the uint32_t counters used in various decoding processes. As a result, the decoding loop may enter a non-terminating state, posing a risk of CPU and memory exhaustion from processing even small file sizes, ultimately harming system performance. Version 1.23.2 has addressed this flaw.

References