Vulnerability RUSTSEC-2026-0458

heifer-isobmff read the item and extent counts of the iloc box (item locations) from the file and allocated memory for them before checking that the box was large enough to hold that many entries. Extents that declare no field at all take zero bytes each, so a small crafted file could declare an enormous number of them. A 42 KB file made parsing allocate several gigabytes, which can exhaust memory and abort the process.

Any application that parses untrusted HEIF/HEIC files with heifer-isobmff, directly or through the heifer crate, is affected: HeifFile::parse and every decoding and metadata function built on it.

The flaw was corrected in 0.3.27 (commit 1a8426e): item and extent counts are bounded by the size of the box, extents that carry no field are rejected, and the total number of extents is capped.