CVE-2026-32739

libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and below, a crafted 800-byte HEIF sequence file causes an infinite loop in Box_stts::get_sample_duration(), consuming 100% CPU indefinitely with zero progress, leading to DoS. The loop has no iteration limit or timeout and is triggered during file open (parsing) - before any user interaction or image decoding. The process stays alive (no crash, no error logged), making it invisible to crash-based monitoring. This issue has been fixed in version 1.22.0.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/strukturag/libheif/releases/tag/v1.22.0	Release Notes
https://github.com/strukturag/libheif/security/advisories/GHSA-j9g7-q9hv-gq8c	Exploit Vendor Advisory
https://github.com/strukturag/libheif/security/advisories/GHSA-j9g7-q9hv-gq8c	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:struktur:libheif:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-05-19 20:16

Updated : 2026-07-24 09:10

NVD link : CVE-2026-32739

Mitre link : CVE-2026-32739

CVE.ORG link : CVE-2026-32739

JSON object : View

Products Affected

struktur

libheif

CWE

CWE-835

Loop with Unreachable Exit Condition ('Infinite Loop')

{"id": "CVE-2026-32739", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-32739", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-20T13:07:06.731430Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "strukturag", "product": "libheif", "versions": [{"status": "affected", "version": "< 1.22.0"}]}]}], "published": "2026-05-19T20:16:18.780", "references": [{"url": "https://github.com/strukturag/libheif/releases/tag/v1.22.0", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/strukturag/libheif/security/advisories/GHSA-j9g7-q9hv-gq8c", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/strukturag/libheif/security/advisories/GHSA-j9g7-q9hv-gq8c", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-835"}]}], "descriptions": [{"lang": "en", "value": "libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and below, a crafted 800-byte HEIF sequence file causes an infinite loop in Box_stts::get_sample_duration(), consuming 100% CPU indefinitely with zero progress, leading to DoS. The loop has no iteration limit or timeout and is triggered during file open (parsing) - before any user interaction or image decoding. The process stays alive (no crash, no error logged), making it invisible to crash-based monitoring. This issue has been fixed in version 1.22.0."}, {"lang": "es", "value": "libheif es un decodificador y codificador de formato de archivo HEIF y AVIF. En las versiones 1.21.2 e inferiores, un archivo de secuencia HEIF de 800 bytes manipulado provoca un bucle infinito en Box_stts::get_sample_duration(), consumiendo el 100% de la CPU indefinidamente sin ning\u00fan progreso, lo que lleva a DoS. El bucle no tiene l\u00edmite de iteraciones ni tiempo de espera y se activa durante la apertura del archivo (an\u00e1lisis), antes de cualquier interacci\u00f3n del usuario o decodificaci\u00f3n de imagen. El proceso permanece activo (sin bloqueo, sin error registrado), lo que lo hace invisible para la monitorizaci\u00f3n basada en bloqueos. Este problema ha sido solucionado en la versi\u00f3n 1.22.0."}], "lastModified": "2026-07-24T09:10:00.153", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:struktur:libheif:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CB01CAAF-1D64-461B-8CC0-3CF2FBAC60A5", "versionEndExcluding": "1.22.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}