RUSTSEC-2026-0456

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0456

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0456.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0456

Aliases

GHSA-rcff-5x58-7w2p

Published

2026-11-04T12:00:00Z

Modified

2026-11-09T10:00:02Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVSS Calculator

Summary

Panic on an HEVC tile layout that does not match the active SPS

Details

An HEVC picture parameter set (PPS) stores explicit tile column widths and row heights computed against the sequence parameter set (SPS) active when it was parsed. A crafted stream can redefine that SPS afterwards, so that the tile sizes add up to more than the picture. The decoder then indexed past its coding tree block tables: Rust's bounds checks turned this into a panic, or the picture was decoded wrongly. A panic aborts the decoding thread, or the whole process when built with panic = "abort". The crate forbids unsafe code, so there is no memory corruption.

Any application that decodes untrusted HEIC files or HEVC streams with heifer-hevc-dec, directly or through the heifer crate, is affected.

The flaw was corrected in 0.3.27 (commit 71dfc67): a tile layout that does not match the picture size is rejected with Error::Invalid at decode time.

Database specific

{
    "license": "CC0-1.0"
}

References

Affected packages

crates.io / heifer-hevc-dec

Package

Name: heifer-hevc-dec; View open source insights on deps.dev
Purl: pkg:cargo/heifer-hevc-dec

Affected ranges

Type: SEMVER
Events: Introduced

0.0.0-0

Fixed

0.3.27

Ecosystem specific

{
    "affected_functions": null,
    "affects": {
        "arch": [],
        "functions": [],
        "os": []
    }
}