ETK-2026-705Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-705",
  "cve_id": null,
  "display_id": "ETK-2026-705",
  "ghsa_id": "GHSA-h4h8-qgvc-m7r2",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "Memory exhaustion in libheif's OpenJPEG decoder",
  "summary": "libheif versions before 1.23.6 can consume several gigabytes of memory while decoding attacker-controlled HEIF content that uses the OpenJPEG JPEG 2000 decoder. An attacker needs an application to process an untrusted HEIF image or sequence with that decoder enabled, potentially disrupting the process or host through memory pressure.",
  "mitigation": "Upgrade libheif to version 1.23.6 or later. If an upgrade cannot be applied immediately, disable or remove the OpenJPEG decoder plugin and avoid processing untrusted JPEG 2000 HEIF content.",
  "vendor": null,
  "product": "libheif",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 1.17.0, <= 1.23.5"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "1.23.6"
      ],
      "package_name": null,
      "purl": null
    }
  ],
  "cwes": [
    770
  ],
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 20.379774816666668,
  "t0_at": null,
  "signals": {
    "public_poc": {
      "at": "2026-10-05T16:41:04+00:00",
      "days": -15.873285366724536,
      "is_lower_bound": true,
      "measured_at": "2026-10-21T13:38:35.885430+00:00",
      "url": "https://github.com/strukturag/libheif/security/advisories/GHSA-h4h8-qgvc-m7r2"
    },
    "trigger_signal": {
      "at": "2026-10-05T16:41:04+00:00",
      "days": -15.873285366724536,
      "is_lower_bound": true,
      "measured_at": "2026-10-21T13:38:35.885430+00:00",
      "url": "https://github.com/strukturag/libheif/security/advisories/GHSA-h4h8-qgvc-m7r2"
    }
  }
}