{"id":"CVE-2026-84446","summary":"libheif: Sequence decode timing-table initialization allows non-terminating loops and unbounded memory, bypassing max_sequence_frames","details":"libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, crafted HEIF sequence timing and edit-list data can make Track::init_sample_timing_table() compute a logical m_num_output_samples value that exceeds the uint32_t counters used by Track_Visual::decode_next_image_sample() and Track::get_next_sample_raw_data(). The resulting comparison can never reach the oversized output count, causing non-terminating decode or raw-sample loops and bypassing max_sequence_frames. The same sequence path repeatedly calls Box_stts::get_sample_duration() and allocates Chunk::m_sample_ranges and Track::m_presentation_timeline outside MemoryHandle accounting, allowing severe CPU and memory exhaustion from a small file. This issue is fixed in version 1.23.2.","aliases":["GHSA-xw34-mjcp-jqh8"],"modified":"2026-09-20T14:24:07.372461Z","published":"2026-09-18T15:54:48.945Z","related":["openSUSE-SU-2026:11719-1"],"database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-835"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84446.json"},"references":[{"type":"WEB","url":"https://github.com/strukturag/libheif/releases/tag/v1.23.2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84446.json"},{"type":"ADVISORY","url":"https://github.com/strukturag/libheif/security/advisories/GHSA-xw34-mjcp-jqh8"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84446"},{"type":"FIX","url":"https://github.com/strukturag/libheif/commit/3a7a69ae325f652e48c026b8241ab25bedf44d9b"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/strukturag/libheif","events":[{"introduced":"0"},{"fixed":"3a7a69ae325f652e48c026b8241ab25bedf44d9b"},{"fixed":"ac1cb05c39008f01525c991ff8b88f84ddf70fd2"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"1.23.2"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["v1.23.1","v1.23.0","v1.22.2","v1.22.1","v1.22.0","v1.21.2","v1.21.1","v1.21.0","v1.20.1","v1.20.0","v1.19.5","v1.19.4","v1.19.3","v1.19.2","v1.19.1","v1.19.0","v1.18.0","v1.18.0-rc1","v1.17.6","v1.17.5","v1.17.4","v1.17.3","v1.17.2","v1.17.1","v1.17.0","v1.16.2","v1.16.1","v1.16.0","v1.15.2","v1.15.1","v1.15.0","v1.14.2","v1.14.1","v1.14.0","v1.13.0","v1.12.0","v1.11.0","v1.10.0","v1.9.1","v1.9.0","v1.8.0","v1.7.0","v1.3.2","v1.3.1","v1.3.0","v1.2.0","v1.1.0"],"database_specific":{"vanir_signatures_modified":"2026-09-20T14:24:07Z","vanir_signatures":[{"deprecated":false,"digest":{"length":707,"function_hash":"214933846367695958294950061772048859597"},"id":"CVE-2026-84446-029d9ddc","signature_type":"Function","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/3a7a69ae325f652e48c026b8241ab25bedf44d9b","target":{"file":"libheif/sequences/chunk.cc","function":"Chunk::Chunk"}},{"target":{"file":"libheif/api/libheif/heif_sequences.cc"},"deprecated":false,"digest":{"line_hashes":["94029682718396319588806886797191216523","190069696010844777553685633794800281652","157637199469358556709478125125418879103","133667808799523002639185476529093575445","143891370381015109635809782430057214092","53754837282514803437296311766165616792","30607554910599198844209773248555536073","139150419137203484310545878824833107548","80722021415917334020000974162728222442","310387943699171552091659672051628357219","232745636699536290086318196903753250699","261712604978385040778555695860293596914","61428428318562086563167339518173129735","113956117180611673704165393897257018736"],"threshold":0.9},"id":"CVE-2026-84446-09b3f0ee","signature_type":"Line","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/3a7a69ae325f652e48c026b8241ab25bedf44d9b"},{"source":"https://github.com/strukturag/libheif/commit/3a7a69ae325f652e48c026b8241ab25bedf44d9b","target":{"file":"libheif/sequences/seq_boxes.cc"},"deprecated":false,"digest":{"line_hashes":["35342666571605865147842612517050220917","287229249279181186612165283850670306511","193092517571909881580793811016546472503","212031746523107034394819109023728139849","117666909314184400028011588435377491458","89309366363186102405416124934718466955","128446776291471556548058936183452513816","92019663638951323149170201904847740895","167411571849218390661339148880009667751","329277373922459985718051206622050699745","145014453656847425005179969989210116144","53144035516234178620266576477161201316","260986193419446679110449712151881417784","219359801539103073724646551234915602043","54951389403599190031828736915953134719","292589724698660979408839187744043983339","104043850816289487094495145384317606598","12226511761367772264028731866512969073","67129963979537695926034775316552667649","36960656503897558628550377796862770047","228853684611296893526348667802072041119"],"threshold":0.9},"id":"CVE-2026-84446-0b2c05cc","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"185392715999676746011866592077050038448","length":395},"id":"CVE-2026-84446-13bd9007","signature_type":"Function","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/3a7a69ae325f652e48c026b8241ab25bedf44d9b","target":{"file":"libheif/api/libheif/heif_sequences.cc","function":"heif_track_get_next_raw_sequence_sample"}},{"deprecated":false,"digest":{"function_hash":"301091381237285897973836195589053381279","length":213},"id":"CVE-2026-84446-228a8c57","signature_type":"Function","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/3a7a69ae325f652e48c026b8241ab25bedf44d9b","target":{"file":"libheif/sequences/seq_boxes.cc","function":"Box_stts::get_sample_duration"}},{"source":"https://github.com/strukturag/libheif/commit/3a7a69ae325f652e48c026b8241ab25bedf44d9b","target":{"file":"libheif/sequences/seq_boxes.h"},"deprecated":false,"digest":{"line_hashes":["67353204229428082407670612129176134445","10692812207201462562933885748077633578","211364489919503480940700103170143993173","139223613953805144407491831216303397455","315030640464771856834684003335890778778"],"threshold":0.9},"id":"CVE-2026-84446-31d08309","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"38824358461025045937522832477378729883","length":1843},"id":"CVE-2026-84446-4bef2533","signature_type":"Function","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/3a7a69ae325f652e48c026b8241ab25bedf44d9b","target":{"file":"libheif/sequences/track.cc","function":"Track::init_sample_timing_table"}},{"deprecated":false,"digest":{"function_hash":"90534910519880226680938961248971161295","length":1399},"id":"CVE-2026-84446-55e37c2e","signature_type":"Function","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/3a7a69ae325f652e48c026b8241ab25bedf44d9b","target":{"file":"libheif/sequences/seq_boxes.cc","function":"Box_stts::parse"}},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["301194703488114485749827611927674985282","236149742013636793873287156916803540744","184861557185270852143382771802330335567","287651502372738151060250743614418482564","233530404088686372445289252625174431405","273880182853305546459092045819632257825","35249592911736603212109717574680429132","205000711021157322006335102950585118919","65542723844925540856241596775039314586","241785518909502806260364525012003950299","4427765169948592768210361105998302589","143011245375944104540908583488221213590","86085322055015326711457787259987479268","147610396356010432821193832871336318859","96857389892209546677945009301182932991","277328950910190322621139731183828446807","15437271226762435511151320630312606529","135766593263803881155127177756619973934","41718405946854162568835712237686891729","74479830168626959110776729428178691035","61059947807228386904395624472003311878","210382586985422541368470054482910342562","49779345414653513690987359238108796627","143725967532070990061829205890473374799","182426421169103345375453900398187277696","70225532830155934633485671969200787828","283664470353904440386406737331270788815","299377539309858620533383321759530846602","145834438365498133511991901320801694992","67797506768090357386383531200422932386","154376768546902061510203289603299476224"]},"id":"CVE-2026-84446-75ea2467","signature_type":"Line","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/3a7a69ae325f652e48c026b8241ab25bedf44d9b","target":{"file":"libheif/sequences/track.cc"}},{"deprecated":false,"digest":{"line_hashes":["55414199801314843977095354184174427886","171775023902277528805886308904533374377","42785001144671198056698880257946971463","250966162490475855616904600887313834149","187833353584362982697324742811061135823","17875534399085799583433075141140164355"],"threshold":0.9},"id":"CVE-2026-84446-84adafeb","signature_type":"Line","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/3a7a69ae325f652e48c026b8241ab25bedf44d9b","target":{"file":"libheif/sequences/chunk.cc"}},{"signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/3a7a69ae325f652e48c026b8241ab25bedf44d9b","target":{"file":"libheif/sequences/chunk.h"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["3784826678204325775113351581638125103","199451691174681918115534036534247690852","280711593927841030182647475176403185055"]},"id":"CVE-2026-84446-a777811d","signature_type":"Line"},{"deprecated":false,"digest":{"function_hash":"239213717329821600948057855253015536995","length":8099},"id":"CVE-2026-84446-c04168c4","signature_type":"Function","signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/3a7a69ae325f652e48c026b8241ab25bedf44d9b","target":{"function":"Track::load","file":"libheif/sequences/track.cc"}},{"source":"https://github.com/strukturag/libheif/commit/3a7a69ae325f652e48c026b8241ab25bedf44d9b","target":{"file":"libheif/sequences/track.h"},"deprecated":false,"digest":{"line_hashes":["197672005116171887413656356606798062540","21617381069090522328108345711639554808","168270884774813619993770027994812981031","203072752521137395174407669768991987854","111095664324108917522022521514880144883","259961189218983245079391918085507965193","252001404115677658987443607680107700763","132516557227872938993828699452646859932","330605546018728396386786181342068490692","93839257526745839880135513582907429674","178529813395056683743241471323432653882"],"threshold":0.9},"id":"CVE-2026-84446-d0a19d08","signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/strukturag/libheif/commit/3a7a69ae325f652e48c026b8241ab25bedf44d9b","target":{"file":"libheif/sequences/seq_boxes.cc","function":"Box_stts::append_sample_duration"},"deprecated":false,"digest":{"function_hash":"71449595084554970561218109862331987921","length":308},"id":"CVE-2026-84446-ffc77356","signature_type":"Function"}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-84446.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}