RUSTSEC-2026-0458

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0458

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0458.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0458

Aliases

GHSA-3243-948x-x627

Published

2026-11-04T12:00:00Z

Modified

2026-11-09T10:00:02Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVSS Calculator

Summary

Memory exhaustion when parsing a crafted `iloc` box

Details

heifer-isobmff read the item and extent counts of the iloc box (item locations) from the file and allocated memory for them before checking that the box was large enough to hold that many entries. Extents that declare no field at all take zero bytes each, so a small crafted file could declare an enormous number of them. A 42 KB file made parsing allocate several gigabytes, which can exhaust memory and abort the process.

Any application that parses untrusted HEIF/HEIC files with heifer-isobmff, directly or through the heifer crate, is affected: HeifFile::parse and every decoding and metadata function built on it.

The flaw was corrected in 0.3.27 (commit 1a8426e): item and extent counts are bounded by the size of the box, extents that carry no field are rejected, and the total number of extents is capped.

Database specific

{
    "license": "CC0-1.0"
}

References

Affected packages

crates.io / heifer-isobmff

Package

Name: heifer-isobmff; View open source insights on deps.dev
Purl: pkg:cargo/heifer-isobmff

Affected ranges

Type: SEMVER
Events: Introduced

0.0.0-0

Fixed

0.3.27

Ecosystem specific

{
    "affected_functions": null,
    "affects": {
        "arch": [],
        "functions": [],
        "os": []
    }
}