USN-8774-1: libheif vulnerabilities
Ubuntu patches libheif image-parsing flaws allowing denial of service or arbitrary code execution (CVE-2026-62291, CVE-2026-62377).
Ubuntu Security Notice USN-8774-1 addresses two vulnerabilities in libheif, the HEIF image library. CVE-2026-62291, discovered by Ali Firas, involves incorrect handling of certain images that could allow an attacker to cause a denial of service or execute arbitrary code. CVE-2026-62377, discovered by Dmitrijs Trizna, involves incorrect handling of image sequences leading to possible denial of service.
- CVE-2026-62291 may allow arbitrary code execution via malformed images.
- CVE-2026-62377 enables denial of service through crafted image sequences.
- Both flaws affect libheif, the open-source HEIF/HEIC image library.
- Fixed via updated libheif packages across supported Ubuntu releases.
- Products
- libheif
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-62291 | Heap out-of-bounds write/read in libheif image sequence decode and re-encode (≤ 1.23.0) | 5.3 | <1% | ||
| CVE-2026-62377 | Reachable assertion / empty-map crash (DoS) in libheif HEIF sequence handling | 4.3 | <1% |
From the original article
Ali Firas discovered that libheif incorrectly handled certain images. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-62291) Dmitrijs Trizna discovered that libheif incorrectly handled certain image sequences.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.