CVE-2026-62377: libheif DOS Vulnerability

CVE-2026-62377 Overview

CVE-2026-62377 is a reachable assertion vulnerability [CWE-617] in libheif, an open-source HEIF and AVIF file format decoder and encoder maintained by Struktur AG. Versions 1.23.0 and earlier fail to safely handle crafted HEIF sequences that contain no registered sequence tracks. When an application calls heif_context_get_track(ctx, 0) after parsing such a file, HeifContext::get_track() in libheif/context.cc triggers assert(has_sequence()), aborting assert-enabled builds. Release builds dereference m_tracks.begin()->second on an empty map, producing undefined behavior that typically crashes the process. The issue is fixed in version 1.23.1.

Critical Impact
Attacker-controlled HEIF input reachable through documented public APIs causes denial of service in applications that link libheif for image decoding.

Affected Products

libheif versions 1.23.0 and earlier
Applications and libraries that link libheif for HEIF or AVIF decoding
Downstream distributions packaging libheif prior to 1.23.1

Discovery Timeline

2026-08-18 - CVE-2026-62377 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-62377

Vulnerability Analysis

libheif exposes heif_context_read_from_memory() and heif_context_get_track() as documented public APIs for parsing HEIF containers and retrieving sequence tracks. A crafted HEIF file can be accepted by the parser while leaving HeifContext with an empty m_tracks map. When a caller subsequently requests track ID zero, execution enters HeifContext::get_track() before any error handling runs.

The function begins with assert(has_sequence()). In builds compiled with assertions enabled, this call terminates the process through abort(). In release builds where NDEBUG disables the assertion, the code reaches a special path that treats track_id == 0 as "return the first track" by dereferencing m_tracks.begin()->second. Because the map is empty, begin() equals end(), and dereferencing that iterator is undefined behavior.

Root Cause

The root cause is a missing precondition check in HeifContext::get_track(). The public wrapper in libheif/api/libheif/heif_sequences.cc is designed to translate errors into null returns for callers, but the assertion fires before that translation can happen. The function assumes callers gated their requests with has_sequence(), an assumption the public API surface does not enforce.

Attack Vector

An attacker delivers a malformed HEIF file to any application that parses untrusted media through libheif. Common exposure points include image thumbnailers, chat clients, mail gateways, and web upload pipelines. User interaction, such as opening or previewing the file, completes the exploitation chain and terminates the host process.

text

 Result<std::shared_ptr<Track>> HeifContext::get_track(uint32_t track_id)
 {
-  assert(has_sequence());
+  // The caller is expected to have confirmed (via has_sequence()) that there are
+  // sequence tracks before requesting one. Guard against an empty track map anyway,
+  // since this is reachable through the public API (e.g. on a still image file).
+  if (!has_sequence()) {
+    return Error{heif_error_Usage_error,
+                 heif_suberror_Unspecified,
+                 "File contains no sequence tracks"};
+  }
 
   if (track_id != 0) {
     auto iter = m_tracks.find(track_id);

Source: GitHub Commit e1a0bc1. The patch replaces the assertion with a proper heif_error_Usage_error return so that release and debug builds behave identically when parsing still-image files or malformed sequences.

Detection Methods for CVE-2026-62377

Indicators of Compromise

Unexpected termination of processes that call libheif APIs when handling HEIF or AVIF content
Core dumps referencing HeifContext::get_track or heif_context_get_track in the crash frames
Repeated crashes of image previewers, thumbnailers, or upload workers processing user-supplied files

Detection Strategies

Inventory installed libheif versions across servers, workstations, and container images to identify builds at 1.23.0 or earlier
Monitor application logs and crash reporters for SIGABRT or SIGSEGV events tied to HEIF or AVIF file processing
Inspect ingestion pipelines for HEIF files that parse successfully but produce zero sequence tracks, a pattern consistent with the crafted input

Monitoring Recommendations

Alert on abnormal termination rates for media-processing services after HEIF or AVIF uploads
Capture and retain crash telemetry from endpoints that render user-supplied images
Track libheif package versions through software bill of materials (SBOM) tooling to detect regressions

How to Mitigate CVE-2026-62377

Immediate Actions Required

Upgrade libheif to version 1.23.1 or later across all systems and container images
Rebuild and redeploy applications that statically link libheif to include the fixed version
Review third-party software for bundled libheif copies and apply vendor updates as they publish patches

Patch Information

The fix is available in the libheif v1.23.1 release and documented in GitHub Security Advisory GHSA-9ww4-9v47-m7pj. Additional context on the reported behavior is in the upstream issue discussion.

Workarounds

Restrict acceptance of HEIF and AVIF files in upload pipelines until patched builds are deployed
Wrap libheif calls with a heif_context_has_sequence() check before invoking heif_context_get_track()
Isolate media parsing in sandboxed processes so that a crash does not disrupt the parent service

bash

# Verify installed libheif version and upgrade where required
pkg-config --modversion libheif
# Debian/Ubuntu
sudo apt-get update && sudo apt-get install --only-upgrade libheif1
# Fedora/RHEL
sudo dnf upgrade libheif
# From source
git clone https://github.com/strukturag/libheif.git
cd libheif && git checkout v1.23.1 && mkdir build && cd build && cmake .. && make && sudo make install