RUSTSEC-2026-0460

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0460

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0460.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0460

Aliases

GHSA-rmc9-8qp4-gjhx

Published

2026-11-04T12:00:00Z

Modified

2026-11-09T10:15:02Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVSS Calculator

Summary

Panic on chroma QP offsets enabled with an empty offset list

Details

An HEVC Range Extensions stream can set cu_chroma_qp_offset_enabled_flag in a slice while its picture parameter set carries an empty chroma QP offset list. The decoder then read the list at the signalled index, which panicked on the out-of-range access. A panic aborts the decoding thread, or the whole process when built with panic = "abort". The crate forbids unsafe code, so there is no memory corruption.

Any application that decodes untrusted HEIC files or HEVC streams with heifer-hevc-dec, directly or through the heifer crate, is affected.

The flaw was corrected in 0.3.27 (commit 1a8426e): with an empty list there is no offset to apply, and the offset is zero.

Database specific

{
    "license": "CC0-1.0"
}

References

Affected packages

crates.io / heifer-hevc-dec

Package

Name: heifer-hevc-dec; View open source insights on deps.dev
Purl: pkg:cargo/heifer-hevc-dec

Affected ranges

Type: SEMVER
Events: Introduced

0.0.0-0

Fixed

0.3.27

Ecosystem specific

{
    "affected_functions": null,
    "affects": {
        "arch": [],
        "functions": [],
        "os": []
    }
}