CVE-2026-50142 — libheif

Unbounded heap allocation in HEIF sequence parser (stsz fixed-size mode)

• Severity: High (CVSS 7.5)
• Advisory: GHSA-jvmp-j3cw-84mh
• Fixed: commit a6caa38 by @farindk
• Time to fix: < 1 hour

Summary

A 1,477-byte crafted HEIF file triggers ~7 GB unchecked heap allocation in Chunk::Chunk() via missing max_sequence_frames check in Box_stsz::parse() fixed-size mode.

Root Cause

seq_boxes.cc:1067 — m_sample_count stored verbatim (no bound check) when m_fixed_sample_size != 0.

Fix

Move max_sequence_frames check outside if (m_fixed_sample_size == 0) branch.