Vulnerability RUSTSEC-2026-0460

An HEVC Range Extensions stream can set cu_chroma_qp_offset_enabled_flag in a slice while its picture parameter set carries an empty chroma QP offset list. The decoder then read the list at the signalled index, which panicked on the out-of-range access. A panic aborts the decoding thread, or the whole process when built with panic = "abort". The crate forbids unsafe code, so there is no memory corruption.

Any application that decodes untrusted HEIC files or HEVC streams with heifer-hevc-dec, directly or through the heifer crate, is affected.

The flaw was corrected in 0.3.27 (commit 1a8426e): with an empty list there is no offset to apply, and the offset is zero.