Vulnerability RUSTSEC-2026-0456

An HEVC picture parameter set (PPS) stores explicit tile column widths and row heights computed against the sequence parameter set (SPS) active when it was parsed. A crafted stream can redefine that SPS afterwards, so that the tile sizes add up to more than the picture. The decoder then indexed past its coding tree block tables: Rust's bounds checks turned this into a panic, or the picture was decoded wrongly. A panic aborts the decoding thread, or the whole process when built with panic = "abort". The crate forbids unsafe code, so there is no memory corruption.

Any application that decodes untrusted HEIC files or HEVC streams with heifer-hevc-dec, directly or through the heifer crate, is affected.

The flaw was corrected in 0.3.27 (commit 71dfc67): a tile layout that does not match the picture size is rejected with Error::Invalid at decode time.