{"id":"CVE-2026-50142","summary":"libheif: unbounded heap allocation in HEIF sequence parser (stsz fixed-size mode missing bound check)","details":"libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.0, a crafted HEIF sequence accepted by heif_context_read_from_memory() with the msf1 sequence brand can cause unbounded heap allocation. In libheif/sequences/seq_boxes.cc, Box_stsz::parse() applies max_sequence_frames only to variable-size samples, so fixed-size mode accepts an attacker-controlled sample_count without a bound. In libheif/sequences/track.cc, Track::load() also adds current_sample_idx and samples_per_chunk in 32-bit arithmetic, allowing the consistency check to be bypassed by wraparound. The resulting values reach the Chunk::Chunk() allocation path, which can consume gigabytes of memory and crash or stall the process through memory exhaustion. This issue is fixed in version 1.23.0.","aliases":["GHSA-jvmp-j3cw-84mh"],"modified":"2026-08-21T08:19:10.425542Z","published":"2026-08-18T21:18:03.652Z","related":["SUSE-SU-2026:22153-1","SUSE-SU-2026:2622-1","openSUSE-SU-2026:10983-1","openSUSE-SU-2026:20974-1"],"database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-190","CWE-770"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50142.json"},"references":[{"type":"WEB","url":"https://github.com/strukturag/libheif/releases/tag/v1.23.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50142.json"},{"type":"ADVISORY","url":"https://github.com/strukturag/libheif/security/advisories/GHSA-jvmp-j3cw-84mh"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50142"},{"type":"FIX","url":"https://github.com/strukturag/libheif/commit/a6caa38f7a70d66dc9caec2a7bfe20935b32c622"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/strukturag/libheif","events":[{"introduced":"c4e4657dcf6bcc06e934632f97736f7c78dbff9e"},{"fixed":"a6caa38f7a70d66dc9caec2a7bfe20935b32c622"},{"fixed":"bd114ed6d592adc92a09882172ab71d1b4c6e1b1"}],"database_specific":{"extracted_events":[{"introduced":"1.19.0"},{"fixed":"1.23.0"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["v1.22.2","v1.22.1","v1.22.0","v1.21.2","v1.21.1","v1.21.0","v1.20.1","v1.20.0","v1.19.5","v1.19.4","v1.19.3","v1.19.2","v1.19.1","v1.19.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-50142.json","vanir_signatures_modified":"2026-08-21T08:19:10Z","vanir_signatures":[{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["107678574240442839434858664497530834807","201150520612872298526437193305135425369","287323728576377618075325709675719333754","136497402417046886356774370573059768870"]},"id":"CVE-2026-50142-3c42a4f9","signature_type":"Line","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/a6caa38f7a70d66dc9caec2a7bfe20935b32c622","target":{"file":"libheif/sequences/track.cc"}},{"digest":{"line_hashes":["51940691057509050895158428570771443855","160815431670480649020441688208435914058","48588574508197323281033400215186834974"],"threshold":0.9},"id":"CVE-2026-50142-66bc825c","signature_type":"Line","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/bd114ed6d592adc92a09882172ab71d1b4c6e1b1","target":{"file":"libheif/api/libheif/heif_error.h"},"deprecated":false},{"source":"https://github.com/strukturag/libheif/commit/a6caa38f7a70d66dc9caec2a7bfe20935b32c622","target":{"file":"libheif/sequences/track.cc","function":"Track::load"},"deprecated":false,"digest":{"function_hash":"266176209535396424243514261305727445797","length":7660},"id":"CVE-2026-50142-7eae69b3","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2026-50142-9701a966","signature_type":"Function","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/a6caa38f7a70d66dc9caec2a7bfe20935b32c622","target":{"file":"libheif/sequences/seq_boxes.cc","function":"Box_stsz::parse"},"deprecated":false,"digest":{"length":1090,"function_hash":"276453865057593039286609641662948858302"}},{"target":{"file":"libheif/api/libheif/heif_library.h"},"deprecated":false,"digest":{"line_hashes":["116950119300098969639621287781294715377","333392259347550849018309434954717500598","59597390676851136634623584557618057676","279247657699216035428068131144829365230","5359382347833662041860081588142131163","124743250369282054336090485170058524293","13406619479365701984898248615599340127","331853525470515161911953389987956138595","107808014574745444593728627088483362522","88748820335139628943318184161304497775","281240122095539981603782255252311210061","115204745032442576630189649426167147875","192407760695879476896265826044851357903"],"threshold":0.9},"id":"CVE-2026-50142-a083e95c","signature_type":"Line","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/bd114ed6d592adc92a09882172ab71d1b4c6e1b1"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/a6caa38f7a70d66dc9caec2a7bfe20935b32c622","target":{"file":"libheif/sequences/seq_boxes.cc"},"deprecated":false,"digest":{"line_hashes":["145699403906946450804575089296741063958","82578832949744444030285143235562438264","57087227992303028387029182257133150073","78123222152462719292554600381004179363","168187940338012618863826234284846136478","185770699403638068290753978845523720063","276890978182146007237875932672230733811","103495835490188645155328161020181881385","123655232127686882445839937053106433398","169495243844982683165056371076587492507","67415774763812859434250639483603848407"],"threshold":0.9},"id":"CVE-2026-50142-b0efea7a"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}