CVE-2026-62377

libheif, a widely used HEIF/AVIF decoder and encoder library, mishandles crafted HEIF sequences that are accepted by heif_context_read_from_memory() but contain no registered sequence tracks. A subsequent call to heif_context_get_track(ctx, 0) reaches HeifContext::get_track() in context.cc, where assert(has_sequence()) executes before normal error handling, so assert-enabled builds abort instead of letting the wrapper in heif_sequences.cc return null; in release builds the track_id-zero path dereferences m_tracks.begin()->second on an empty map, which is undefined behavior and typically crashes the process. An attacker who can supply a malicious HEIF/AVIF file to an application using these documented public APIs can therefore cause a denial of service (CVSS C:N/I:N/A:L, with user interaction required to open the file). Any application, service, or distribution package linking libheif 1.23.0 or earlier and parsing untrusted media through these APIs is affected; Ubuntu has issued USN-8774-1 for its libheif packages. There is no known public PoC, the issue is not in CISA KEV, and EPSS estimates only a ~0.3% chance of exploitation in the next 30 days.

What to do: Upgrade libheif to version 1.23.1 or later, and on Ubuntu apply the package updates from USN-8774-1; rebuild statically linked applications against the patched library. Applications using the sequence APIs should additionally validate that a context contains tracks before calling heif_context_get_track(), and treat untrusted HEIF/AVIF inputs (e.g., uploads, thumbnails) as suspect until patched.