CVE-2026-50142

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-50142
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-50142.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-50142
Aliases
  • GHSA-jvmp-j3cw-84mh
Downstream
Related
Published
2026-08-18T21:18:03.652Z
Modified
2026-08-21T08:19:10.425542Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
libheif: unbounded heap allocation in HEIF sequence parser (stsz fixed-size mode missing bound check)
Details

libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.0, a crafted HEIF sequence accepted by heifcontextreadfrommemory() with the msf1 sequence brand can cause unbounded heap allocation. In libheif/sequences/seqboxes.cc, Boxstsz::parse() applies maxsequenceframes only to variable-size samples, so fixed-size mode accepts an attacker-controlled samplecount without a bound. In libheif/sequences/track.cc, Track::load() also adds currentsampleidx and samplesper_chunk in 32-bit arithmetic, allowing the consistency check to be bypassed by wraparound. The resulting values reach the Chunk::Chunk() allocation path, which can consume gigabytes of memory and crash or stall the process through memory exhaustion. This issue is fixed in version 1.23.0.

Database specific 
{
    "cwe_ids": [
        "CWE-190",
        "CWE-770"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50142.json"
}
References

Affected packages

Git / github.com/strukturag/libheif

Affected ranges

Type
GIT
Repo
https://github.com/strukturag/libheif
Events
Introduced
c4e4657dcf6bcc06e934632f97736f7c78dbff9e
Fixed
a6caa38f7a70d66dc9caec2a7bfe20935b32c622
Fixed
bd114ed6d592adc92a09882172ab71d1b4c6e1b1
Database specific
Show details 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "1.19.0"
        },
        {
            "fixed": "1.23.0"
        }
    ]
}

Affected versions

v1.*
v1.19.0
v1.19.1
v1.19.2
v1.19.3
v1.19.4
v1.19.5
v1.20.0
v1.20.1
v1.21.0
v1.21.1
v1.21.2
v1.22.0
v1.22.1
v1.22.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-50142.json"
vanir_signatures 
[
    {
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "107678574240442839434858664497530834807",
                "201150520612872298526437193305135425369",
                "287323728576377618075325709675719333754",
                "136497402417046886356774370573059768870"
            ]
        },
        "target": {
            "file": "libheif/sequences/track.cc"
        },
        "source": "https://github.com/strukturag/libheif/commit/a6caa38f7a70d66dc9caec2a7bfe20935b32c622",
        "signature_version": "v1",
        "id": "CVE-2026-50142-3c42a4f9",
        "deprecated": false
    },
    {
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "51940691057509050895158428570771443855",
                "160815431670480649020441688208435914058",
                "48588574508197323281033400215186834974"
            ]
        },
        "target": {
            "file": "libheif/api/libheif/heif_error.h"
        },
        "source": "https://github.com/strukturag/libheif/commit/bd114ed6d592adc92a09882172ab71d1b4c6e1b1",
        "signature_version": "v1",
        "id": "CVE-2026-50142-66bc825c",
        "deprecated": false
    },
    {
        "signature_type": "Function",
        "digest": {
            "function_hash": "266176209535396424243514261305727445797",
            "length": 7660.0
        },
        "target": {
            "function": "Track::load",
            "file": "libheif/sequences/track.cc"
        },
        "source": "https://github.com/strukturag/libheif/commit/a6caa38f7a70d66dc9caec2a7bfe20935b32c622",
        "signature_version": "v1",
        "id": "CVE-2026-50142-7eae69b3",
        "deprecated": false
    },
    {
        "signature_type": "Function",
        "digest": {
            "function_hash": "276453865057593039286609641662948858302",
            "length": 1090.0
        },
        "target": {
            "function": "Box_stsz::parse",
            "file": "libheif/sequences/seq_boxes.cc"
        },
        "source": "https://github.com/strukturag/libheif/commit/a6caa38f7a70d66dc9caec2a7bfe20935b32c622",
        "signature_version": "v1",
        "id": "CVE-2026-50142-9701a966",
        "deprecated": false
    },
    {
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "116950119300098969639621287781294715377",
                "333392259347550849018309434954717500598",
                "59597390676851136634623584557618057676",
                "279247657699216035428068131144829365230",
                "5359382347833662041860081588142131163",
                "124743250369282054336090485170058524293",
                "13406619479365701984898248615599340127",
                "331853525470515161911953389987956138595",
                "107808014574745444593728627088483362522",
                "88748820335139628943318184161304497775",
                "281240122095539981603782255252311210061",
                "115204745032442576630189649426167147875",
                "192407760695879476896265826044851357903"
            ]
        },
        "target": {
            "file": "libheif/api/libheif/heif_library.h"
        },
        "source": "https://github.com/strukturag/libheif/commit/bd114ed6d592adc92a09882172ab71d1b4c6e1b1",
        "signature_version": "v1",
        "id": "CVE-2026-50142-a083e95c",
        "deprecated": false
    },
    {
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "145699403906946450804575089296741063958",
                "82578832949744444030285143235562438264",
                "57087227992303028387029182257133150073",
                "78123222152462719292554600381004179363",
                "168187940338012618863826234284846136478",
                "185770699403638068290753978845523720063",
                "276890978182146007237875932672230733811",
                "103495835490188645155328161020181881385",
                "123655232127686882445839937053106433398",
                "169495243844982683165056371076587492507",
                "67415774763812859434250639483603848407"
            ]
        },
        "target": {
            "file": "libheif/sequences/seq_boxes.cc"
        },
        "source": "https://github.com/strukturag/libheif/commit/a6caa38f7a70d66dc9caec2a7bfe20935b32c622",
        "signature_version": "v1",
        "id": "CVE-2026-50142-b0efea7a",
        "deprecated": false
    }
]
vanir_signatures_modified 
"2026-08-21T08:19:10Z"