Detections
Analytics
CVE-2026-50142
medium
Description
The vulnerability exists due to a missing boundary check on the sample size (stsz) box fixed-size parameter inside the HEIF sequence parser of libheif. When a malformed image sequence is parsed, the missing verification step triggers an unbounded heap memory allocation loop, enabling an attacker to induce severe system resource exhaustion or local denial of service (DoS).