USN-8774-1: libheif vulnerabilities

libheif, a widely used open-source HEIF/AVIF decoder and encoder, fails to validate that an auxiliary alpha plane's dimensions match the main frame when decoding image sequences: Track_Visual::decode_next_image_sample() passes an inconsistent image downstream, and during re-encoding unc_encoder_component_interleave::encode_tile() allocates its buffer using the primary dimensions while copying each component using its actual plane dimensions, causing an attacker-controlled heap out-of-bounds write (and, with the inverse mismatch, an out-of-bounds read). The flaw is triggered by decoding a crafted image sequence (a 2x2 primary plane with a 256x256 alpha plane is a demonstrated trigger) in a normal decode-and-re-encode workflow, so an attacker gains heap corruption that can crash the application (DoS) and potentially enable memory-corruption exploitation with limited confidentiality, integrity, and availability impact per the CVSS scoring. Any application or system that decodes untrusted HEIF/AVIF image sequences with libheif 1.23.0 or earlier is affected, including Linux distributions that ship the library, as confirmed by Ubuntu security notice USN-8774-1. No public proof-of-concept is known, the flaw is not in CISA KEV, and EPSS estimates only a 0.1% probability of exploitation within 30 days, so no exploitation is currently known.

Do: Upgrade libheif to version 1.23.1, or apply the distro update provided in Ubuntu USN-8774-1 (and equivalent updates in other distributions that package libheif). Until patched, avoid processing untrusted HEIF/AVIF image sequences in tools that decode and re-encode/transcode images with libheif (viewers, thumbnailers, transcoders, ImageMagick/vips-style pipelines that link it). Inventory systems and applications for linked libheif builds to confirm they receive the fixed version.

libheif, a widely used HEIF/AVIF decoder and encoder library, mishandles crafted HEIF sequences that are accepted by heif_context_read_from_memory() but contain no registered sequence tracks. A subsequent call to heif_context_get_track(ctx, 0) reaches HeifContext::get_track() in context.cc, where assert(has_sequence()) executes before normal error handling, so assert-enabled builds abort instead of letting the wrapper in heif_sequences.cc return null; in release builds the track_id-zero path dereferences m_tracks.begin()->second on an empty map, which is undefined behavior and typically crashes the process. An attacker who can supply a malicious HEIF/AVIF file to an application using these documented public APIs can therefore cause a denial of service (CVSS C:N/I:N/A:L, with user interaction required to open the file). Any application, service, or distribution package linking libheif 1.23.0 or earlier and parsing untrusted media through these APIs is affected; Ubuntu has issued USN-8774-1 for its libheif packages. There is no known public PoC, the issue is not in CISA KEV, and EPSS estimates only a ~0.3% chance of exploitation in the next 30 days.

Do: Upgrade libheif to version 1.23.1 or later, and on Ubuntu apply the package updates from USN-8774-1; rebuild statically linked applications against the patched library. Applications using the sequence APIs should additionally validate that a context contains tracks before calling heif_context_get_track(), and treat untrusted HEIF/AVIF inputs (e.g., uploads, thumbnails) as suspect until patched.