GHSA-rcff-5x58-7w2p
Panic on an HEVC tile layout that does not match the active SPS
GHSA-rcff-5x58-7w2p is a medium vulnerability (CVSS 6.5) in heifer-hevc-dec, published November 4, 2026. No source lists public exploit code. Fixed in heifer-hevc-dec 0.3.27.
- Severity
- 6.5 MediumCVSS 3.1, OSV
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
0.3.27heifer-hevc-dec
Description
An HEVC picture parameter set (PPS) stores explicit tile column widths and row
heights computed against the sequence parameter set (SPS) active when it was
parsed. A crafted stream can redefine that SPS afterwards, so that the tile sizes
add up to more than the picture. The decoder then indexed past its coding tree
block tables: Rust's bounds checks turned this into a panic, or the picture was
decoded wrongly. A panic aborts the decoding thread, or the whole process when
built with panic = "abort". The crate forbids unsafe code, so there is no
memory corruption.
Any application that decodes untrusted HEIC files or HEVC streams with
heifer-hevc-dec, directly or through the heifer crate, is affected.
The flaw was corrected in 0.3.27 (commit
71dfc67):
a tile layout that does not match the picture size is rejected with
Error::Invalid at decode time.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Affected packages
| Package | Affected | Fixed |
|---|---|---|
heifer-hevc-deccrates.io | 0.0.0-0 up to 0.3.27 | 0.3.27 |
What each source reports
OSV Score usedRUSTSEC-2026-0456
Panic on an HEVC tile layout that does not match the active SPS
An HEVC picture parameter set (PPS) stores explicit tile column widths and row
heights computed against the sequence parameter set (SPS) active when it was
parsed. A crafted stream can redefine that SPS afterwards, so that the tile sizes
add up to more than the picture. The decoder then indexed past its coding tree
block tables: Rust's bounds checks turned this into a panic, or the picture was
decoded wrongly. A panic aborts the decoding thread, or the whole process when
built with panic = "abort". The crate forbids unsafe code, so there is no
memory corruption.
Any application that decodes untrusted HEIC files or HEVC streams with
heifer-hevc-dec, directly or through the heifer crate, is affected.
The flaw was corrected in 0.3.27 (commit
71dfc67):
a tile layout that does not match the picture size is rejected with
Error::Invalid at decode time.
- Record
RUSTSEC-2026-0456- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-09
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.