CVE-2026-50142 strukturag CVE debrief

Who should care

Defenders responsible for systems handling HEIF and AVIF files, particularly those using libheif versions 1.19.0 to 1.22.0, should assess exposure and prioritize updating to version 1.23.0 or later. They should review and update systems handling HEIF and AVIF files, monitor for potential memory exhaustion attacks, and verify libheif version and system exposure.

Why it matters

Defenders should prioritize verifying and updating libheif to version 1.23.0 or later due to a potential memory exhaustion vulnerability in versions 1.19.0 to 1.22.0.

• Potential memory exhaustion through unbounded heap allocation
• Possible process crashes or stalls due to memory exhaustion
• Need for verification of libheif version and system exposure
• Priority for updating libheif to version 1.23.0 or later

Technical summary

A crafted HEIF sequence accepted by heif_context_read_from_memory() with the msf1 sequence brand can cause unbounded heap allocation in libheif versions 1.19.0 to 1.22.0. The vulnerability allows for potential memory exhaustion through unbounded heap allocation, possible process crashes or stalls due to memory exhaustion. In libheif/sequences/seq_boxes.cc, Box_stsz::parse() applies max_sequence_frames only to variable-size samples, so fixed-size mode accepts an attacker-controlled sample_count without a bound. In libheif/sequences/track.cc, Track::load() also adds current_sample_idx and samples_per_chunk in 32-bit arithmetic, allowing the consistency check to be bypassed by wraparound. The resulting values can

Defensive priority

Defenders should prioritize verifying and updating libheif to version 1.23.0 or later, especially in systems handling HEIF and AVIF files.

Recommended defensive actions

• Verify and update libheif to version 1.23.0 or later
• Review and update systems handling HEIF and AVIF files
• Monitor for potential memory exhaustion attacks
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. The vulnerability is caused by a crafted HEIF sequence accepted by heif_context_read_from_memory() with the msf1 sequence brand, which can cause unbounded heap allocation in libheif versions 1.19.0 to 1.22.0. The issue is fixed in version 1.23.0. Defenders should verify and update libheif to version 1.23.0 or later, review and update systems handling HEIF and AVIF files, and monitor for potential memory The

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.