GHSA-3243-948x-x627
Memory exhaustion when parsing a crafted `iloc` box
GHSA-3243-948x-x627 is a medium vulnerability (CVSS 6.5) in heifer-isobmff, published November 4, 2026. No source lists public exploit code. Fixed in heifer-isobmff 0.3.27.
- Severity
- 6.5 MediumCVSS 3.1, OSV
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
0.3.27heifer-isobmff
Description
heifer-isobmff read the item and extent counts of the iloc box (item
locations) from the file and allocated memory for them before checking that the
box was large enough to hold that many entries. Extents that declare no field at
all take zero bytes each, so a small crafted file could declare an enormous
number of them. A 42 KB file made parsing allocate several gigabytes, which can
exhaust memory and abort the process.
Any application that parses untrusted HEIF/HEIC files with heifer-isobmff,
directly or through the heifer crate, is affected: HeifFile::parse and every
decoding and metadata function built on it.
The flaw was corrected in 0.3.27 (commit
1a8426e):
item and extent counts are bounded by the size of the box, extents that carry no
field are rejected, and the total number of extents is capped.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Affected packages
| Package | Affected | Fixed |
|---|---|---|
heifer-isobmffcrates.io | 0.0.0-0 up to 0.3.27 | 0.3.27 |
What each source reports
OSV Score usedRUSTSEC-2026-0458
Memory exhaustion when parsing a crafted `iloc` box
heifer-isobmff read the item and extent counts of the iloc box (item
locations) from the file and allocated memory for them before checking that the
box was large enough to hold that many entries. Extents that declare no field at
all take zero bytes each, so a small crafted file could declare an enormous
number of them. A 42 KB file made parsing allocate several gigabytes, which can
exhaust memory and abort the process.
Any application that parses untrusted HEIF/HEIC files with heifer-isobmff,
directly or through the heifer crate, is affected: HeifFile::parse and every
decoding and metadata function built on it.
The flaw was corrected in 0.3.27 (commit
1a8426e):
item and extent counts are bounded by the size of the box, extents that carry no
field are rejected, and the total number of extents is capped.
- Record
RUSTSEC-2026-0458- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-09
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.