CVE-2026-50142: libheif DoS Vulnerability

CVE-2026-50142 Overview

CVE-2026-50142 is a high-severity integer overflow and unbounded allocation vulnerability [CWE-190] in libheif, an open-source HEIF and AVIF file format decoder and encoder maintained by Struktur AG. The flaw affects versions from 1.19.0 up to but not including 1.23.0. A crafted HEIF sequence with the msf1 sequence brand, when processed through heif_context_read_from_memory(), can trigger unbounded heap allocation. The result is process crash or stall via memory exhaustion, producing a network-reachable denial-of-service condition against any application that decodes untrusted HEIF sequences.

Critical Impact
A single malicious HEIF file can consume gigabytes of memory and crash or stall any application using vulnerable libheif builds to decode untrusted media.

Affected Products

libheif versions 1.19.0 through 1.22.x
Applications and platforms bundling vulnerable libheif for HEIF/AVIF decoding
Image processing pipelines and media servers that accept HEIF sequences from untrusted sources

Discovery Timeline

2026-08-18 - CVE-2026-50142 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-50142

Vulnerability Analysis

The vulnerability resides in libheif's sequence box parsing logic. When a HEIF file uses the msf1 sequence brand, parsing reaches Box_stsz::parse() in libheif/sequences/seq_boxes.cc. The parser reads an attacker-controlled 32-bit sample_count from the input. The max_sequence_frames security limit was only enforced for variable-size samples, so fixed-size mode accepted any sample_count without bound.

A second flaw compounds the issue in Track::load() inside libheif/sequences/track.cc. The consistency check current_sample_idx + sampleToChunk.samples_per_chunk > m_stsz->num_samples() executed in 32-bit arithmetic. An attacker can trigger integer wraparound to bypass the check. Both paths funnel attacker-controlled values into Chunk::Chunk() allocation, producing multi-gigabyte allocations.

Root Cause

Two related defects drive the vulnerability. First, a missing bounds check for fixed-size sample mode in the stsz box parser. Second, 32-bit integer arithmetic in a consistency check that permits wraparound, defeating the guard on downstream allocations. Both are classic CWE-190 integer-handling errors.

Attack Vector

Exploitation requires no authentication and no user interaction beyond causing a target application to decode a crafted HEIF file. Any network-facing service that ingests HEIF or AVIF media, such as image conversion APIs, thumbnail generators, chat platforms, or webmail attachment previewers, is reachable over the network.

text

// Patch to libheif/sequences/seq_boxes.cc — Box_stsz::parse()
// Enforces max_sequence_frames for BOTH fixed-size and variable-size modes

   m_fixed_sample_size = range.read32();
   m_sample_count = range.read32();
 
+  if (limits->max_sequence_frames > 0 && m_sample_count > limits->max_sequence_frames) {
+    return {
+      heif_error_Memory_allocation_error,
+      heif_suberror_Security_limit_exceeded,
+      "Security limit for maximum number of sequence frames exceeded"
+    };
+  }
+
   if (m_fixed_sample_size == 0) {
     // check required memory
 
-    if (limits->max_sequence_frames > 0 && m_sample_count > limits->max_sequence_frames) {
-      return {
-        heif_error_Memory_allocation_error,
-        heif_suberror_Security_limit_exceeded,
-        "Security limit for maximum number of sequence frames exceeded"
-      };
-    }
-
     uint64_t mem_size = m_sample_count * sizeof(uint32_t);
     if (auto err = m_memory_handle.alloc(mem_size, limits, "the 'stsz' table")) {
       return err;

// Patch to libheif/sequences/track.cc — Track::load()
// Promotes the check to 64-bit to prevent wraparound

-    if (current_sample_idx + sampleToChunk.samples_per_chunk > m_stsz->num_samples()) {
+    if (static_cast<uint64_t>(current_sample_idx) + sampleToChunk.samples_per_chunk > m_stsz->num_samples()) {
       return {
         heif_error_Invalid_input,
         heif_suberror_Unspecified,

Source: libheif commit a6caa38

Detection Methods for CVE-2026-50142

Indicators of Compromise

HEIF/AVIF files declaring the msf1 sequence brand with an unusually large sample_count field in the stsz box
Process crashes or out-of-memory kills in services that decode HEIF media
Sudden multi-gigabyte resident memory growth in image-processing worker processes

Detection Strategies

Inventory installed libheif versions across servers, containers, and desktop images; flag any build between 1.19.0 and 1.22.x
Inspect HEIF inputs at the gateway for oversized stsz sample counts before they reach the decoder
Run fuzzed HEIF corpora against pre-production builds to confirm the fixed version rejects malformed sequences with heif_suberror_Security_limit_exceeded

Monitoring Recommendations

Alert on process memory growth exceeding configured limits for image-decoding workers
Track OOM-killer events and segmentation faults on services that ingest user-supplied media
Log libheif error codes at the application layer and alert on heif_error_Memory_allocation_error spikes

How to Mitigate CVE-2026-50142

Immediate Actions Required

Upgrade libheif to version 1.23.0 or later on all systems that decode HEIF or AVIF content
Rebuild and redeploy applications that statically link against libheif
Restrict maximum accepted file size and reject HEIF sequences from untrusted origins until patched

Patch Information

The fix is included in libheif 1.23.0. See the libheif v1.23.0 release notes and the upstream GitHub Security Advisory GHSA-jvmp-j3cw-84mh. The patch enforces max_sequence_frames for fixed-size samples and promotes the sample index consistency check to 64-bit arithmetic.

Workarounds

Configure heif_security_limits.max_sequence_frames to a conservative value in host applications where a rebuild against 1.23.0 is not yet possible
Disable HEIF sequence decoding for untrusted inputs where feasible
Sandbox image-decoding workers with per-process memory limits (for example, RLIMIT_AS or cgroup memory caps) to bound impact

bash

# Ubuntu/Debian: verify and upgrade libheif
dpkg -l | grep libheif
sudo apt-get update && sudo apt-get install --only-upgrade libheif1

# Container image rebuild — pin to fixed upstream release
# In Dockerfile:
#   RUN git clone --branch v1.23.0 https://github.com/strukturag/libheif.git

# Runtime memory cap for a decoder worker (systemd unit)
# [Service]
# MemoryMax=512M
# MemoryHigh=384M