{"id":"CVE-2026-50142","title":"libheif is a HEIF and AVIF file format decoder and encoder","summary":"libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.0, a crafted HEIF sequence accepted by heif_context_read_from_memory() with the msf1 sequence brand can cause unbounded heap allocation. In libheif/sequen…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-190","CWE-770"],"published":"2026-08-18","updated":"2026-09-09","sourceUpdated":"2026-09-09T21:13:25.910","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-50142","references":[{"url":"https://github.com/strukturag/libheif/commit/a6caa38f7a70d66dc9caec2a7bfe20935b32c622","label":"security-advisories@github.com"},{"url":"https://github.com/strukturag/libheif/releases/tag/v1.23.0","label":"security-advisories@github.com"},{"url":"https://github.com/strukturag/libheif/security/advisories/GHSA-jvmp-j3cw-84mh","label":"security-advisories@github.com"}],"tags":["nvd","exploit-available"],"epss":0.00655,"epssPercentile":0.49171,"exploits":{"github":1,"githubRepos":["https://github.com/MuhammedHussein17/libheif-cve-2026-50142"],"checkedAt":"2026-09-25T08:21:00.731Z"},"exploitAvailable":true,"ingestedAt":"2026-09-09T21:22:45.538Z","slug":"CVE-2026-50142","body":"## Overview\n\nlibheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.0, a crafted HEIF sequence accepted by heif_context_read_from_memory() with the msf1 sequence brand can cause unbounded heap allocation. In libheif/sequences/seq_boxes.cc, Box_stsz::parse() applies max_sequence_frames only to variable-size samples, so fixed-size mode accepts an attacker-controlled sample_count without a bound. In libheif/sequences/track.cc, Track::load() also adds current_sample_idx and samples_per_chunk in 32-bit arithmetic, allowing the consistency check to be bypassed by wraparound. The resulting values reach the Chunk::Chunk() allocation path, which can consume gigabytes of memory and crash or stall the process through memory exhaustion. This issue is fixed in version 1.23.0.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":53,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[]}