libheif EUVD-2026-30972

The vulnerability triggers specifically when libheif processes a HEIF sequence file (not a still image) containing an stsc box where the samples_per_chunk field is set to zero - a value the library accepts without error during initial parsing. Exploitation requires that the target application actually attempt to access a sample (frame) from the file; merely opening or loading the file container is insufficient to crash the process. Per the CVSS vector (PR:N), no authentication is required. User interaction is required (UI:R) in the sense that a user or automated process must trigger a frame decode operation on the crafted file. Exploitation is strictly limited to availability impact (denial of service via process crash); the CVSS vector confirms no confidentiality or integrity loss (C:N, I:N), and the description provides no mechanism for memory content exposure or code execution. Environments that automatically process all uploaded HEIF content (e.g., image pipeline workers, thumbnail generators) effectively remove the human interaction barrier, making those deployments higher priority for patching.

The CVSS 3.1 score of 6.5 (Medium) accurately reflects the constrained impact profile: the attack vector is network (AV:N) with low complexity (AC:L) and no required privileges (PR:N), but user interaction is required (UI:R) and scope is unchanged (S:U). Impact is entirely on availability (A:H) with no confidentiality or integrity loss per the vector. One data quality flag: the source tags include 'Information Disclosure,' which conflicts with the CVSS C:N rating and the CVE description's exclusive focus on a DoS outcome - this should be verified against the full vendor advisory at GHSA-7f2h-cmpf-v9ww before treating any information exposure as confirmed. No EPSS score was provided, and the vulnerability is not listed in CISA KEV, making active exploitation unconfirmed. Real-world risk is moderate and most acute in server-side HEIF processing pipelines (e.g., image upload handlers, CDN transcoding, photo management services) where automated parsing of untrusted content can effectively eliminate the UI:R barrier described in the CVSS vector. For end-user desktop applications, exploitation requires social engineering to open a malicious file.

An attacker constructs a 792-byte HEIF sequence file with samples_per_chunk=0 embedded in the stsc box - a malformation requiring only basic knowledge of ISOBMFF structure - and delivers it to a target via email attachment, web content, or an upload form processed by a server running libheif. When the application attempts to decode the first video frame or image tile, libheif dereferences index 0 of an empty std::vector, crashing the process with a SEGV. No public exploit code has been identified at time of analysis, but the deterministic crash and small file size (792 bytes) make this highly reproducible once the file format specification is consulted.