Medium severity6.5NVD Advisory· Published May 19, 2026· Updated May 20, 2026
CVE-2026-32739
CVE-2026-32739
Description
libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and below, a crafted 800-byte HEIF sequence file causes an infinite loop in Box_stts::get_sample_duration(), consuming 100% CPU indefinitely with zero progress, leading to DoS. The loop has no iteration limit or timeout and is triggered during file open (parsing) - before any user interaction or image decoding. The process stays alive (no crash, no error logged), making it invisible to crash-based monitoring. This issue has been fixed in version 1.22.0.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
6(expand)+ 1 more
- (no CPE)
- (no CPE)range: <=1.21.2
- osv-coords4 versionspkg:rpm/opensuse/libheif&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/libheif&distro=openSUSE%20Tumbleweedpkg:rpm/suse/libheif&distro=SUSE%20Linux%20Enterprise%20Server%2016.0pkg:rpm/suse/libheif&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0
< 1.23.0-160000.1.1+ 3 more
- (no CPE)range: < 1.23.0-160000.1.1
- (no CPE)range: < 1.22.2-1.1
- (no CPE)range: < 1.23.0-160000.1.1
- (no CPE)range: < 1.23.0-160000.1.1
Patches
Vulnerability mechanics
References
2- github.com/strukturag/libheif/security/advisories/GHSA-j9g7-q9hv-gq8cnvdExploitVendor Advisory
- github.com/strukturag/libheif/releases/tag/v1.22.0nvdRelease Notes
News mentions
0No linked articles in our index yet.