{"id":"RUSTSEC-2026-0458","summary":"Memory exhaustion when parsing a crafted `iloc` box","details":"`heifer-isobmff` read the item and extent counts of the `iloc` box (item\nlocations) from the file and allocated memory for them before checking that the\nbox was large enough to hold that many entries. Extents that declare no field at\nall take zero bytes each, so a small crafted file could declare an enormous\nnumber of them. A 42 KB file made parsing allocate several gigabytes, which can\nexhaust memory and abort the process.\n\nAny application that parses untrusted HEIF/HEIC files with `heifer-isobmff`,\ndirectly or through the `heifer` crate, is affected: `HeifFile::parse` and every\ndecoding and metadata function built on it.\n\nThe flaw was corrected in 0.3.27 (commit\n[`1a8426e`](https://github.com/HarpeLm/Heifer/commit/1a8426e1b41160fb48d8baf8be858238570a8093)):\nitem and extent counts are bounded by the size of the box, extents that carry no\nfield are rejected, and the total number of extents is capped.","aliases":["GHSA-3243-948x-x627"],"modified":"2026-11-09T10:00:02.350064057Z","published":"2026-11-04T12:00:00Z","database_specific":{"license":"CC0-1.0"},"references":[{"type":"PACKAGE","url":"https://crates.io/crates/heifer-isobmff"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0458.html"},{"type":"WEB","url":"https://github.com/HarpeLm/Heifer/commit/1a8426e1b41160fb48d8baf8be858238570a8093"}],"affected":[{"package":{"name":"heifer-isobmff","ecosystem":"crates.io","purl":"pkg:cargo/heifer-isobmff"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.3.27"}]}],"ecosystem_specific":{"affects":{"os":[],"functions":[],"arch":[]},"affected_functions":null},"database_specific":{"informational":null,"categories":["denial-of-service"],"cvss":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0458.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}]}