libheif CVE-2026-84446

Requires the target to decode an attacker-supplied HEIF/AVIF *sequence* (multi-sample/video-style) file with crafted stts timing and edit-list data that drives Track::init_sample_timing_table() to compute an m_num_output_samples exceeding the uint32_t counters in Track_Visual::decode_next_image_sample() and Track::get_next_sample_raw_data(), bypassing the max_sequence_frames safeguard. Exploitation is limited to libheif versions prior to 1.23.2 and only when the sequence decode path (not a single still image) is exercised; the practical limiting factor is that some consumer is set up to decode untrusted HEIF sequences automatically - automated/server-side pipelines match UI:N, whereas desktop viewers effectively require the user to open the file (UI:R), which constrains real-world reach.

This is a genuine but bounded-impact issue: the vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) reflects a pure availability impact (CWE-835 infinite loop plus unaccounted allocation), with no confidentiality or integrity effect. Exploitation status is 'no public exploit identified at time of analysis' - there is no EPSS score, no CISA KEV listing, and no POC provided in the input; the only referenced code artifact is the fix commit and its regression-oriented advisory (GHSA-xw34-mjcp-jqh8), not weaponized exploit code. The vector's UI:N/PR:N implies drive-by, unauthenticated triggering, which is accurate for automated server-side pipelines that decode uploaded HEIF/AVIF sequences; however, the description explicitly requires a crafted HEIF sequence to actually be decoded, so for desktop/interactive viewers a user-interaction element (UI:R) is arguably more honest and would lower real-world severity slightly. Net: a real, easy-to-trigger DoS worth patching in any service that ingests untrusted HEIF sequences, but not a critical, exploited-in-the-wild priority - no code execution, no data exposure, and no evidence of active exploitation.

An attacker uploads or delivers a small crafted HEIF/AVIF file whose sequence timing (stts) and edit-list data cause Track::init_sample_timing_table() to compute a logical output-sample count exceeding the uint32_t loop counters, so the terminating comparison is never satisfied. When a server-side thumbnailing or media-processing pipeline (e.g., an image host, gallery service, or CMS using libheif via ImageMagick/libvips) decodes the file, the decode/raw-sample loop never terminates and the unaccounted Chunk::m_sample_ranges / m_presentation_timeline allocations grow, pinning a CPU core and exhausting memory from a tiny input. No public exploit code is identified, but the trigger conditions are fully described in the advisory and fixed by a clamp in 1.23.2.