CyberRota Analysis
AI-Generatedlibheif versions prior to 1.23.2 are vulnerable to a denial-of-service attack due to improper handling of crafted HEIF sequence timing and edit-list data, which can lead to infinite decoding loops and excessive CPU and memory consumption. This vulnerability poses a significant risk to applications utilizing libheif for media processing, as it can be exploited by malicious files to disrupt service. Organizations using affected versions should prioritize updating to version 1.23.2 to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, crafted HEIF sequence timing and edit-list data can make Track::init_sample_timing_table() compute a logical m_num_output_samples value that exceeds the uint32_t counters used by Track_Visual::decode_next_image_sample() and Track::get_next_sample_raw_data(). The resulting comparison can never reach the oversized output count, causing non-terminating decode or raw-sample loops and bypassing max_sequence_frames. The same sequence path repeatedly calls Box_stts::get_sample_duration() and allocates Chunk::m_sample_ranges and Track::m_presentation_timeline outside MemoryHandle accounting, allowing severe CPU and memory exhaustion from a small file. This issue is fixed in version 1.23.2.