The vulnerability of the Box_stts::get_sample_duration() function in the HEIF and AVIF file encoding/decoding library allows a perpetrator to trigger a service failure.

The vulnerability of the Boxstts::getsampleduration function in the HEIF and AVIF file encoding/decoding library lies in the execution of a loop with an unreachable exit condition. Exploiting this vulnerability could allow a malicious actor to cause service failures...

SUSE CVE-2026-32739

libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and below, a crafted 800-byte HEIF sequence file causes an infinite loop in Boxstts::getsampleduration, consuming 100% CPU indefinitely with zero progress, leading to DoS. The loop has no iteration limit or timeout and...