CVE-2026-62377

Received Received - Intake

Heap Buffer Overflow in libheif Image Decoder

Publication date: 2026-08-18

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description

libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF sequence accepted by heif_context_read_from_memory() can leave the context with no registered sequence tracks and crash when heif_context_get_track(ctx, 0) is called. HeifContext::get_track() in libheif/context.cc executes assert(has_sequence()) before its normal error handling, so assert-enabled builds abort instead of allowing the public wrapper in libheif/api/libheif/heif_sequences.cc to return null. In release builds, removing the assertion lets the track_id zero path dereference m_tracks.begin()->second on an empty map, which is undefined behavior and typically crashes. The issue is reachable through documented public APIs after parsing attacker-controlled bytes. This issue is fixed in version 1.23.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-19

Generated

2026-09-08

AI Q&A

2026-08-19

EPSS Evaluated

2026-09-07

NVD

CVE-2026-62377

Affected Vendors & Products

Vendor	Product	Version / Range
structuralbits	libheif	1.23.1
structuralbits	libheif	to 1.23.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-908	The product uses or accesses a resource that has not been initialized.
CWE-617	The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

Attack-Flow Graph

Executive Summary

This vulnerability in libheif versions 1.23.0 and earlier allows a crafted HEIF file to crash the program when processed. The issue occurs because the library fails to properly handle sequence tracks during parsing, leading to an assertion failure in debug builds or a crash in release builds due to undefined behavior.

Detection Guidance

This vulnerability can be detected by checking the version of libheif installed on your system. If you are running version 1.23.0 or earlier, your system is vulnerable. Use the command 'heif-info --version' or 'dpkg -l | grep libheif' to check the installed version.

Impact Analysis

An attacker could exploit this by providing a maliciously crafted HEIF file, causing the application using libheif to crash. This could lead to denial-of-service conditions or potential further exploitation depending on the application's context.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a denial-of-service issue in libheif that causes crashes when processing malformed HEIF files. Compliance impacts would only occur if the crash disrupts systems handling regulated data, but the vulnerability itself is not a data breach or privacy violation.

Mitigation Strategies

Immediately upgrade libheif to version 1.23.1 or later. This can typically be done using your package manager, such as 'apt-get upgrade libheif1' for Debian-based systems or 'yum update libheif' for RHEL-based systems.

Hi! I’m here to help you understand CVE-2026-62377. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70