Skip to main content

libheif CVE-2026-32739

| EUVDEUVD-2026-30975 MEDIUM
Loop with Unreachable Exit Condition (Infinite Loop) (CWE-835)
2026-05-19 GitHub_M
Denial Of Service Libheif Strukturag
6.5
CVSS 3.1 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
SUSE
MEDIUM
qualitative
Red Hat
6.5 MEDIUM
qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

3
Source Code Evidence Fetched
May 19, 2026 - 20:18 vuln.today
Analysis Generated
May 19, 2026 - 20:18 vuln.today
Patch available
May 19, 2026 - 20:02 EUVD

DescriptionCVE.org

libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and below, a crafted 800-byte HEIF sequence file causes an infinite loop in Box_stts::get_sample_duration(), consuming 100% CPU indefinitely with zero progress, leading to DoS. The loop has no iteration limit or timeout and is triggered during file open (parsing) - before any user interaction or image decoding. The process stays alive (no crash, no error logged), making it invisible to crash-based monitoring. This issue has been fixed in version 1.22.0.

AnalysisAI

Infinite CPU loop denial-of-service in libheif 1.21.2 and below allows a remote unauthenticated attacker to permanently exhaust a victim application's CPU by delivering a crafted 800-byte HEIF sequence file. The vulnerability triggers during file parsing in Box_stts::get_sample_duration() before any image decoding occurs, meaning any application that opens user-supplied HEIF files is exposed at the moment of file open. No KEV listing and no public exploit have been identified at time of analysis, but the low attack complexity and high availability impact make this a meaningful risk for deployments that process untrusted HEIF content. Vendor-released patch version 1.22.0 resolves the issue.

Technical ContextAI

libheif (CPE: cpe:2.3:a:strukturag:libheif:*:*:*:*:*:*:*:*) is an open-source C++ library by strukturag for decoding and encoding HEIF (High Efficiency Image Format) and AVIF files, widely embedded in image-processing pipelines, media servers, and applications. HEIF files are structured as ISO Base Media File Format (ISOBMFF) containers; the Box_stts box holds sample-to-time tables used to derive frame durations during container parsing. CWE-835 (Loop with Unreachable Exit Condition) describes the root cause: Box_stts::get_sample_duration() contains an iteration path with no exit condition, timeout, or progress guard. Because the loop is entered during initial file parsing rather than during image decoding, every code path that calls the library's file-open function is affected - including server-side batch processors, headless converters, and any UI that triggers parsing before displaying a preview. The trigger file is only 800 bytes, making delivery via email attachment, web upload, or messaging trivial.

RemediationAI

Upgrade libheif to version 1.22.0 or later; this is the vendor-confirmed fix, available at https://github.com/strukturag/libheif/releases/tag/v1.22.0. The fix resolves the unbounded loop in Box_stts::get_sample_duration() and is confirmed by both the GitHub release and the GHSA advisory. For deployments that cannot immediately patch, compensating controls include: restricting HEIF file ingestion to authenticated, trusted sources only (reducing the attack surface to internal actors rather than arbitrary internet users); running libheif-based processing in isolated worker processes with CPU time limits (e.g., POSIX RLIMIT_CPU or cgroup cpu.cfs_quota_us) so that an infinite loop is killed automatically by the OS rather than starving the host - note this introduces processing latency and requires restart logic; and rejecting HEIF sequence files (as opposed to still images) at an upstream content-type or magic-bytes filter, since the vulnerable code path is specific to sequence containers. These workarounds carry operational trade-offs (dropped legitimate files, added infrastructure complexity) and are explicitly secondary to patching.

More in Libheif

View all
CVE-2023-49464 HIGH POC
8.8 Dec 07

libheif v1.17.5 was discovered to contain a segmentation violation via the function UncompressedImageCodec::get_luma_bit
CVE-2023-49463 HIGH POC
8.8 Dec 07

libheif v1.17.5 was discovered to contain a segmentation violation via the function find_exif_tag at /libheif/exif.cc. R
CVE-2023-49462 HIGH POC
8.8 Dec 07

libheif v1.17.5 was discovered to contain a segmentation violation via the component /libheif/exif.cc. Rated high severi
CVE-2023-49460 HIGH POC
8.8 Dec 07

libheif v1.17.5 was discovered to contain a segmentation violation via the function UncompressedImageCodec::decode_uncom
CVE-2019-11471 HIGH POC
8.8 Apr 23

libheif 1.4.0 has a use-after-free in heif::HeifContext::Image::set_alpha_channel in heif_context.h because heif_context
CVE-2024-41311 HIGH POC
8.1 Oct 15

In Libheif 1.17.6, insufficient checks in ImageOverlay::parse() decoding a heif file containing an overlay image with fo
CVE-2024-25269 HIGH POC
7.5 Mar 05

libheif <= 1.17.6 contains a memory leak in the function JpegEncoder::Encode. Rated high severity (CVSS 7.5), this vulne
CVE-2023-29659 MEDIUM POC
6.5 May 05

A Segmentation fault caused by a floating point exception exists in libheif 1.15.1 using crafted heif images via the hei
CVE-2025-29482 MEDIUM POC
6.2 Apr 07

Buffer Overflow vulnerability in libheif 1.19.7 allows a local attacker to execute arbitrary code via the SAO (Sample Ad
CVE-2026-32740 HIGH
8.8 May 19

Heap buffer overflow write in libheif (versions ≤ 1.21.2) lets a crafted HEIF/AVIF file write 64 bytes of attacker-contr
CVE-2026-47178 HIGH
7.8 Jul 21

Arbitrary code execution in libheif 1.19.0 through 1.21.2 via a crafted HEIF file with uncompressed, tiled, component-in
CVE-2023-0996 HIGH
7.8 Feb 24

There is a vulnerability in the strided image data parsing code in the emscripten wrapper for libheif. Rated high severi

Same weakness CWE-835 – Loop with Unreachable Exit Condition (Infinite Loop)

View all
CVE-2024-20353 HIGH POC
8.6
CVE-2020-13935 HIGH POC
7.5
CVE-2017-16944 HIGH POC
7.5
CVE-2022-0778 HIGH POC
7.5
CVE-2024-43366 CRITICAL POC
9.1
CVE-2026-25533 HIGH POC
8.8
CVE-2018-8002 HIGH POC
8.8
CVE-2026-66730 HIGH POC
8.7

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP7 Fixed

Share

CVE-2026-32739 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy