CVE-2026-32739
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
libheif versions 1.21.2 and below are vulnerable to a DoS attack via an infinite loop in Box_stts::get_sample_duration(). A crafted 800-byte HEIF file causes 100% CPU usage with no progress, leading to denial of service. The issue occurs during file opening, before any user interaction.
Risk Assessment
The risk involves easy DoS attacks on systems using libheif, potentially leading to service unavailability and resource exhaustion.
Recommendation
Upgrade libheif to version 1.22.0 or later, which includes a fix for this vulnerability.
Original NVD description (English source)
libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and below, a crafted 800-byte HEIF sequence file causes an infinite loop in Box_stts::get_sample_duration(), consuming 100% CPU indefinitely with zero progress, leading to DoS. The loop has no iteration limit or timeout and is triggered during file open (parsing) - before any user interaction or image decoding. The process stays alive (no crash, no error logged), making it invisible to crash-based monitoring. This issue has been fixed in version 1.22.0.