Description
libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF sequence accepted by heif_context_read_from_memory() can leave the context with no registered sequence tracks and crash when heif_context_get_track(ctx, 0) is called. HeifContext::get_track() in libheif/context.cc executes assert(has_sequence()) before its normal error handling, so assert-enabled builds abort instead of allowing the public wrapper in libheif/api/libheif/heif_sequences.cc to return null. In release builds, removing the assertion lets the track_id zero path dereference m_tracks.begin()->second on an empty map, which is undefined behavior and typically crashes. The issue is reachable through documented public APIs after parsing attacker-controlled bytes. This issue is fixed in version 1.23.1.
Published: 2026-08-18
Score: 4.3 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A crafted HEIF sequence causes libheif to accept a file that contains no registered sequence tracks. When the public API heif_context_get_track(ctx, 0) is called, the internal assertion HeifContext::get_track() executes an assert that the sequence exists. In assertion-enabled builds this aborts the process; in release builds the subsequent undefined dereference typically crashes. The failure is not a code execution flaw but results in a crash that can terminate image processing services or applications that use libheif.

Affected Systems

The vulnerability affects version 1.23.0 and all earlier releases of strukturag libheif. Any software that links to libheif and uses the heif_context_read_from_memory() API, such as image viewers, editors, or media servers, is impacted if the library is built without defensive checks or in a context where assertion handling leads to abort. The problem is shown to be fixed in libheif 1.23.1.

Risk and Exploitability

The CVSS base score of 4.3 reflects a moderate impact with local scope. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack surface requires the attacker to supply a specially crafted HEIF file, typically through a file upload or media pipeline. Because the crash is predictable and reachable via documented public functions, an attacker who can influence the input to a libheif-using process can reliably cause a denial of service.

Generated by OpenCVE AI on August 19, 2026 at 00:23 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade libheif to version 1.23.1 or later and rebuild all dependent applications to link against the updated library.
  • If an immediate upgrade is not possible, isolate the libheif decoding operation in a sandboxed or monitored process that can contain crashes and recover gracefully.
  • Ensure that all input files are validated before passing them to libheif, for example by checking that the sequence track list is non‑empty or by using the library’s safer decoding APIs where available.

Generated by OpenCVE AI on August 19, 2026 at 00:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 18 Aug 2026 21:30:00 +0000

Type Values Removed Values Added
Description libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF sequence accepted by heif_context_read_from_memory() can leave the context with no registered sequence tracks and crash when heif_context_get_track(ctx, 0) is called. HeifContext::get_track() in libheif/context.cc executes assert(has_sequence()) before its normal error handling, so assert-enabled builds abort instead of allowing the public wrapper in libheif/api/libheif/heif_sequences.cc to return null. In release builds, removing the assertion lets the track_id zero path dereference m_tracks.begin()->second on an empty map, which is undefined behavior and typically crashes. The issue is reachable through documented public APIs after parsing attacker-controlled bytes. This issue is fixed in version 1.23.1.
Title libheif: Reachable assertion in HeifContext::get_track() aborts on a valid-but-empty HEIF sequence file (context.cc:2110)
Weaknesses CWE-617
CWE-908
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-18T21:22:29.899Z

Reserved: 2026-07-13T22:04:59.678Z

Link: CVE-2026-62377

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-18T22:17:03.167

Modified: 2026-08-18T22:17:03.167

Link: CVE-2026-62377

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-19T00:30:04Z

Weaknesses