{"id":"CVE-2026-62377","aliases":["BELL-CVE-2026-62377","DEBIAN-CVE-2026-62377","EUVD-2026-62191","GHSA-9ww4-9v47-m7pj","SUSE-SU-2026:23320-1","SUSE-SU-2026:3597-1","UBUNTU-CVE-2026-62377","USN-8774-1","openSUSE-SU-2026:11416-1","openSUSE-SU-2026:21644-1"],"status":"published","title":"libheif: Reachable assertion in HeifContext::get_track() aborts on a valid-but-empty HEIF sequence file (context.cc:2110)","description":"libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF sequence accepted by heif_context_read_from_memory() can leave the context with no registered sequence tracks and crash when heif_context_get_track(ctx, 0) is called. HeifContext::get_track() in libheif/context.cc executes assert(has_sequence()) before its normal error handling, so assert-enabled builds abort instead of allowing the public wrapper in libheif/api/libheif/heif_sequences.cc to return null. In release builds, removing the assertion lets the track_id zero path dereference m_tracks.begin()-\u003esecond on an empty map, which is undefined behavior and typically crashes. The issue is reachable through documented public APIs after parsing attacker-controlled bytes. This issue is fixed in version 1.23.1.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00413,"percentile":0.36097,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-617","CWE-908"],"published":"2026-08-01T00:00:00Z","modified":"2026-10-28T11:18:20Z","fixes":[{"ecosystem":"Alpaquita:stream","package":"libheif","fixed_in":["1.23.4-r0"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libheif","fixed_in":["1.23.1-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"libheif","fixed_in":["1.21.2-3ubuntu0.5"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpaquita:stream","package":"libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.20.2-r2"},{"fixed":"1.23.4-r0"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.1-1"}]}],"versions":["1.19.8-1","1.20.1-1","1.20.2-1","1.20.2-2","1.21.2-1","1.21.2-2","1.21.2-3","1.21.2-4"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.1-160000.1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.1-160000.1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP7","package":"libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.1-150700.3.18.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.1-150700.3.18.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.2-3ubuntu0.5"}]}],"versions":["1.20.2-1","1.20.2-2","1.20.2-2build1","1.20.2-2build2","1.20.2-2ubuntu1","1.21.2-1","1.21.2-3","1.21.2-3ubuntu0.1","1.21.2-3ubuntu0.2","1.21.2-3ubuntu0.3","1.21.2-3ubuntu0.4"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.2-3ubuntu0.5"}]}],"versions":["1.20.2-1","1.20.2-2","1.20.2-2build1","1.20.2-2build2","1.20.2-2ubuntu1","1.21.2-1","1.21.2-3","1.21.2-3ubuntu0.1","1.21.2-3ubuntu0.2","1.21.2-3ubuntu0.3","1.21.2-3ubuntu0.4"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.1-1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"libheif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.1-160000.1.1"}]}],"bundled":4}],"products":[{"vendor":"strukturag","product":"libheif"}],"references":[{"url":"https://github.com/strukturag/libheif/security/advisories/GHSA-9ww4-9v47-m7pj","tags":["x_refsource_CONFIRM","advisory","report"]},{"url":"https://github.com/strukturag/libheif/issues/1844","tags":["x_refsource_MISC","report"]},{"url":"https://github.com/strukturag/libheif/commit/e1a0bc1c1ae74f8075eaca30a1cdb2b9bee698d3","tags":["x_refsource_MISC","fix","report"]},{"url":"https://github.com/strukturag/libheif/releases/tag/v1.23.1","tags":["x_refsource_MISC","web","report"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-62377","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/62xxx/CVE-2026-62377.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62377","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-62377","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623320-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1273079","tags":["report"]},{"url":"https://bugzilla.suse.com/1273080","tags":["report"]},{"url":"https://bugzilla.suse.com/1273081","tags":["report"]},{"url":"https://bugzilla.suse.com/1273082","tags":["report"]},{"url":"https://bugzilla.suse.com/1273083","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-62289","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-62291","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-62292","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-62377","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263597-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-62377","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-62377","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8774-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-62291","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-62377","title":"libheif: Reachable assertion in HeifContext::get_track() aborts on a valid-but-empty HEIF sequence file (context.cc:2110)","description":"libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF sequence accepted by heif_context_read_from_memory() can leave the context with no registered sequence tracks and crash when heif_context_get_track(ctx, 0) is called. HeifContext::get_track() in libheif/context.cc executes assert(has_sequence()) before its normal error handling, so assert-enabled builds abort instead of allowing the public wrapper in libheif/api/libheif/heif_sequences.cc to return null. In release builds, removing the assertion lets the track_id zero path dereference m_tracks.begin()-\u003esecond on an empty map, which is undefined behavior and typically crashes. The issue is reachable through documented public APIs after parsing attacker-controlled bytes. This issue is fixed in version 1.23.1.","status":"published","published":"2026-08-18T21:22:29.899Z","modified":"2026-08-19T18:19:50.593Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-617","CWE-908"],"updated_at":"2026-11-02T14:20:14.999906Z"}],"euvd":[{"id":"EUVD-2026-62191","description":"libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF sequence accepted by heif_context_read_from_memory() can leave the context with no registered sequence tracks and crash when heif_context_get_track(ctx, 0) is called. HeifContext::get_track() in libheif/context.cc executes assert(has_sequence()) before its normal error handling, so assert-enabled builds abort instead of allowing the public wrapper in libheif/api/libheif/heif_sequences.cc to return null. In release builds, removing the assertion lets the track_id zero path dereference m_tracks.begin()-\u003esecond on an empty map, which is undefined behavior and typically crashes. The issue is reachable through documented public APIs after parsing attacker-controlled bytes. This issue is fixed in version 1.23.1.","status":"published","published":"2026-08-18T21:22:29Z","modified":"2026-08-19T18:19:50Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T18:01:40.9092Z"}],"nvd":[{"id":"CVE-2026-62377","description":"libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF sequence accepted by heif_context_read_from_memory() can leave the context with no registered sequence tracks and crash when heif_context_get_track(ctx, 0) is called. HeifContext::get_track() in libheif/context.cc executes assert(has_sequence()) before its normal error handling, so assert-enabled builds abort instead of allowing the public wrapper in libheif/api/libheif/heif_sequences.cc to return null. In release builds, removing the assertion lets the track_id zero path dereference m_tracks.begin()-\u003esecond on an empty map, which is undefined behavior and typically crashes. The issue is reachable through documented public APIs after parsing attacker-controlled bytes. This issue is fixed in version 1.23.1.","status":"published","published":"2026-08-18T22:17:03.167Z","modified":"2026-10-22T16:09:59.56Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-617","CWE-908"],"updated_at":"2026-11-02T14:12:39.620837Z"}],"osv":[{"id":"BELL-CVE-2026-62377","status":"published","published":"2026-08-21T06:06:41.719205Z","modified":"2026-10-02T07:15:02.397354884Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:28:24.959902Z"},{"id":"CVE-2026-62377","title":"libheif: Reachable assertion in HeifContext::get_track() aborts on a valid-but-empty HEIF sequence file (context.cc:2110)","description":"libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF sequence accepted by heif_context_read_from_memory() can leave the context with no registered sequence tracks and crash when heif_context_get_track(ctx, 0) is called. HeifContext::get_track() in libheif/context.cc executes assert(has_sequence()) before its normal error handling, so assert-enabled builds abort instead of allowing the public wrapper in libheif/api/libheif/heif_sequences.cc to return null. In release builds, removing the assertion lets the track_id zero path dereference m_tracks.begin()-\u003esecond on an empty map, which is undefined behavior and typically crashes. The issue is reachable through documented public APIs after parsing attacker-controlled bytes. This issue is fixed in version 1.23.1.","status":"published","published":"2026-08-18T21:22:29.899Z","modified":"2026-10-28T11:18:20.455736103Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-617","CWE-908"],"updated_at":"2026-11-02T15:45:13.306117Z"},{"id":"DEBIAN-CVE-2026-62377","description":"libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF sequence accepted by heif_context_read_from_memory() can leave the context with no registered sequence tracks and crash when heif_context_get_track(ctx, 0) is called. HeifContext::get_track() in libheif/context.cc executes assert(has_sequence()) before its normal error handling, so assert-enabled builds abort instead of allowing the public wrapper in libheif/api/libheif/heif_sequences.cc to return null. In release builds, removing the assertion lets the track_id zero path dereference m_tracks.begin()-\u003esecond on an empty map, which is undefined behavior and typically crashes. The issue is reachable through documented public APIs after parsing attacker-controlled bytes. This issue is fixed in version 1.23.1.","status":"published","published":"2026-08-18T22:17:03.167Z","modified":"2026-10-23T17:47:40.664133186Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:57.932517Z"},{"id":"UBUNTU-CVE-2026-62377","description":"libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF sequence accepted by heif_context_read_from_memory() can leave the context with no registered sequence tracks and crash when heif_context_get_track(ctx, 0) is called. HeifContext::get_track() in libheif/context.cc executes assert(has_sequence()) before its normal error handling, so assert-enabled builds abort instead of allowing the public wrapper in libheif/api/libheif/heif_sequences.cc to return null. In release builds, removing the assertion lets the track_id zero path dereference m_tracks.begin()-\u003esecond on an empty map, which is undefined behavior and typically crashes. The issue is reachable through documented public APIs after parsing attacker-controlled bytes. This issue is fixed in version 1.23.1.","status":"published","published":"2026-08-18T22:17:00Z","modified":"2026-09-18T23:45:03.2212275Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T16:56:43.630667Z"},{"id":"openSUSE-SU-2026:11416-1","title":"gdk-pixbuf-loader-libheif-1.23.1-1.1 on GA media","description":"These are all security issues fixed in the gdk-pixbuf-loader-libheif-1.23.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-01T00:00:00Z","modified":"2026-08-02T11:45:08.020230581Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:21644-1","title":"Security update for libheif","description":"This update for libheif fixes the following issues:\n\nUpdate to version 1.23.1 (jsc#PED-16355).\n\nSecurity issues fixed:\n\n- CVE-2026-62289: integer underflow in Fraction constructor via double clap transform application (bsc#1273079).\n- CVE-2026-62291: heap out-of-bounds write in the uncompressed encoder when writing images with mismatched auxiliary\n  alpha dimensions (bsc#1273080).\n- CVE-2026-62292: out-of-bounds read in uncompressed unci tile range slicing (bsc#1273081).\n- CVE-2026-62377: reachable assertion in `HeifContext::get_track()` aborts on a valid-but-empty HEIF sequence file\n  (bsc#1273082).\n- Heap out-of-bounds write in the uncompressed encoder for RRGGBB images with interleaved bit-depth `\u003c= 8`\n  (bsc#1273083).\n\nChanges for libheif:\n\n- Version 1.23.1\n  + FFmpeg decoder plugin gains AV1, VVC, JPEG, and JPEG 2000/HTJ2K decoding.\n  + SVT-AV1 encoder: new `tune=iq` and `ms-ssim` tune parameters.\n  + C++ API: added getters/setters for the CLLI and MDCV HDR metadata boxes.\n  + Sequence decoder now scales the alpha auxiliary track to the main image size.\n  + Fixed pixi box writing for multi-channel images.\n  + Corrected the placement of the TAI `clock_type` field into the top 2 bits.\n  + Empty/unset plugin directory is no longer scanned.\n","status":"published","published":"2026-08-25T06:33:48Z","modified":"2026-08-27T18:23:13.590222309Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:23320-1","title":"Security update for libheif","description":"This update for libheif fixes the following issues:\n\nUpdate to version 1.23.1 (jsc#PED-16355).\n\nSecurity issues fixed:\n\n- CVE-2026-62289: integer underflow in Fraction constructor via double clap transform application (bsc#1273079).\n- CVE-2026-62291: heap out-of-bounds write in the uncompressed encoder when writing images with mismatched auxiliary\n  alpha dimensions (bsc#1273080).\n- CVE-2026-62292: out-of-bounds read in uncompressed unci tile range slicing (bsc#1273081).\n- CVE-2026-62377: reachable assertion in `HeifContext::get_track()` aborts on a valid-but-empty HEIF sequence file\n  (bsc#1273082).\n- Heap out-of-bounds write in the uncompressed encoder for RRGGBB images with interleaved bit-depth `\u003c= 8`\n  (bsc#1273083).\n\nChanges for libheif:\n\n- Version 1.23.1\n  + FFmpeg decoder plugin gains AV1, VVC, JPEG, and JPEG 2000/HTJ2K decoding.\n  + SVT-AV1 encoder: new `tune=iq` and `ms-ssim` tune parameters.\n  + C++ API: added getters/setters for the CLLI and MDCV HDR metadata boxes.\n  + Sequence decoder now scales the alpha auxiliary track to the main image size.\n  + Fixed pixi box writing for multi-channel images.\n  + Corrected the placement of the TAI `clock_type` field into the top 2 bits.\n  + Empty/unset plugin directory is no longer scanned.\n","status":"published","published":"2026-08-25T06:32:48Z","modified":"2026-09-10T18:23:10.51923243Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:3597-1","title":"Security update for libheif","description":"This update for libheif fixes the following issues:\n\nUpdate to version 1.23.1 (jsc#PED-16355).\n\nSecurity issues fixed:\n\n- CVE-2026-62289: integer underflow in Fraction constructor via double clap transform application (bsc#1273079).\n- CVE-2026-62291: heap out-of-bounds write in the uncompressed encoder when writing images with mismatched auxiliary\n  alpha dimensions (bsc#1273080).\n- CVE-2026-62292: out-of-bounds read in uncompressed unci tile range slicing (bsc#1273081).\n- CVE-2026-62377: reachable assertion in `HeifContext::get_track()` aborts on a valid-but-empty HEIF sequence file\n  (bsc#1273082).\n- Heap out-of-bounds write in the uncompressed encoder for RRGGBB images with interleaved bit-depth `\u003c= 8`\n  (bsc#1273083).\n\nChanges for libheif:\n\n- Version 1.23.1\n  + FFmpeg decoder plugin gains AV1, VVC, JPEG, and JPEG 2000/HTJ2K decoding.\n  + SVT-AV1 encoder: new `tune=iq` and `ms-ssim` tune parameters.\n  + C++ API: added getters/setters for the CLLI and MDCV HDR metadata boxes.\n  + Sequence decoder now scales the alpha auxiliary track to the main image size.\n  + Fixed pixi box writing for multi-channel images.\n  + Corrected the placement of the TAI `clock_type` field into the top 2 bits.\n  + Empty/unset plugin directory is no longer scanned.\n","status":"published","published":"2026-08-12T11:48:46Z","modified":"2026-08-13T09:30:09.120531898Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"USN-8774-1","title":"libheif vulnerabilities","description":"Ali Firas discovered that libheif incorrectly handled certain images. An\nattacker could possibly use this issue to cause a denial of service or\nexecute arbitrary code. (CVE-2026-62291)\n\nDmitrijs Trizna discovered that libheif incorrectly handled certain image\nsequences. An attacker could possibly use this issue to cause a denial of\nservice. (CVE-2026-62377)","status":"published","published":"2026-09-16T16:36:02Z","modified":"2026-09-18T23:56:34.304770073Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}