ETK-2026-2718Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-2718",
  "cve_id": null,
  "display_id": "ETK-2026-2718",
  "ghsa_id": "GHSA-hhg3-fxg7-3gxw",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "CPU exhaustion from crafted HEIF files in libheif",
  "summary": "libheif 1.21.0 through 1.23.6 can perform excessive CPU work while opening specially formed HEIF files. An attacker who can cause an application to process an untrusted HEIF file may tie up workers, including thumbnailing or decoding services.",
  "mitigation": "Upgrade libheif to version 1.23.7. Until upgrades are complete, restrict or isolate processing of untrusted HEIF files and apply resource limits to workers that handle them.",
  "vendor": "other",
  "product": "libheif",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 1.21.0, < 1.23.7"
      ],
      "ecosystem": "other",
      "fixed_versions": [
        "1.23.7"
      ],
      "package_name": "libheif",
      "purl": null
    }
  ],
  "cwes": [
    407
  ],
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 40.0446578,
  "t0_at": null,
  "signals": {
    "trigger_signal": {
      "at": "2026-10-26T11:51:56+00:00",
      "days": -0.7978176555092592,
      "is_lower_bound": true,
      "measured_at": "2026-10-27T07:00:47.490200+00:00",
      "url": "https://github.com/strukturag/libheif/security/advisories/GHSA-hhg3-fxg7-3gxw"
    }
  }
}