CVE-2026-32739 libheif is Vulnerable to Infinite Loop DoS via stts Sample Duration Lookup
A crafted HEIF file triggers an infinite loop in libheif, causing a denial of service by consuming 100% CPU during file parsing.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-32739?
CVE-2026-32739 is a medium-severity denial of service vulnerability in strukturag libheif, published on 19 May 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and below, a crafted 800-byte HEIF sequence file causes an infinite loop in Box_stts::get_sample_duration(), consuming 100% CPU indefinitely with zero progress, leading to DoS. The loop has no iteration limit or timeout and is triggered during file open (parsing) - before any user interaction or image decoding. The process stays alive (no crash, no error logged), making it invisible to crash-based monitoring. This issue has been fixed in version 1.22.0.
Weakness: CWE-835
Which versions are affected by CVE-2026-32739?
It affects 1 product.
Products include Struktur Libheif.
How do I fix CVE-2026-32739?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-32739 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-32739 exists.
Other vulnerabilities in strukturag libheif
Sources
Also known as ALPINE-CVE-2026-32739, BELL-CVE-2026-32739, DEBIAN-CVE-2026-32739, GHSA-j9g7-q9hv-gq8c, JLSEC-2026-571, ROOT-OS-DEBIAN-11-CVE-2026-32739 and 2 more.