libheif CVE-2026-32739

Exploitation requires that a victim application or automated process opens or parses a crafted HEIF sequence file using libheif 1.21.2 or below. The CVSS vector (UI:R) reflects that a user or automated process must trigger file parsing; in server-side pipelines that auto-process uploads, this condition is met without explicit human interaction. PR:N confirms no attacker authentication is required. The vulnerable code path is triggered specifically by HEIF sequence containers (not still HEIF/AVIF images), during the container parsing phase before any image decoding or user-facing interaction occurs. Exploitation is limited to availability impact only - there is no code execution, memory corruption, or data exfiltration component. Limiting factors include: only libheif versions below 1.22.0 are affected; deployments that do not accept external HEIF files are not exposed; and applications that sandbox or CPU-limit file-processing workers can contain the impact even if triggered.

The CVSS 6.5 score reflects a medium-severity availability-only impact (C:N/I:N/A:H) with no confidentiality or integrity consequence. The vector AV:N/AC:L/PR:N/UI:R indicates the attack is network-reachable with low complexity and requires no attacker authentication, but does require user interaction - specifically, a victim must open or process the crafted file. In server-side or automated pipelines (image upload processors, thumbnail generators) the UI:R flag is practically irrelevant because the 'user interaction' is the automated processing trigger. EPSS data was not provided in the input; no CISA KEV listing is present. No public exploit code has been identified at time of analysis. Despite the moderate CVSS score, the operational impact is disproportionate: the process does not crash (bypassing crash-based alerting), logs no error, and consumes 100% of a CPU core indefinitely - making detection and recovery operationally difficult. The attack is also highly automatable given the tiny payload size and the fact that parsing occurs before any validation gate. For deployments that accept user-supplied HEIF files without sandboxing, this vulnerability represents a realistic and high-priority denial-of-service vector.

An attacker crafts an 800-byte malicious HEIF sequence file designed to trigger the unbounded loop in Box_stts::get_sample_duration(). The file is submitted to a web service that processes user-uploaded images (e.g., a profile photo uploader or media transcoder built on libheif). The moment the backend calls the library's file-open or parse function, the processing thread enters an infinite loop with no error output, permanently pegging one CPU core and rendering the worker thread unresponsive - with repeated submissions, all worker threads can be exhausted, taking the service offline. No public exploit code has been identified, but the attack requires only a crafted file and knowledge of the affected function, making independent reproduction straightforward.