AIKIDO-2026-574855

TL;DR

libheif follows the alpha auxiliary (auxl) edge while decoding an image, but the cycle guard is recorded only on a copy of the decode state, so the parent decode frame never observes it. A crafted file whose alpha auxiliary items reference each other re-enters decode_image on an item whose non-recursive decode mutex is still held, permanently deadlocking the decode thread. This lets a single malformed file hang decoding indefinitely. The fix records the item id on the decode path so the reference cycle is detected.