Skip to main content

libheif CVE-2026-62377

| EUVDEUVD-2026-62191 MEDIUM
Reachable Assertion (CWE-617)
2026-08-18 security-advisories@github.com
Denial Of Service Suse
4.3
CVSS 3.1 · Vendor: github
Share

Severity by source

Vendor (github) PRIMARY
4.3 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
vuln.today AI
4.3 MEDIUM

Network-delivered crafted file; no auth required; UI:R for user-opened file path; availability impact is process-level crash only with no disclosure.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE
3.3 MEDIUM
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Primary rating from Vendor (github).

CVSS VectorVendor: github

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low

Lifecycle Timeline

3
Source Code Evidence Fetched
Aug 19, 2026 - 04:55 vuln.today
Analysis Generated
Aug 19, 2026 - 04:55 vuln.today
Patch available
Aug 18, 2026 - 22:19 EUVD

DescriptionCVE.org

libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF sequence accepted by heif_context_read_from_memory() can leave the context with no registered sequence tracks and crash when heif_context_get_track(ctx, 0) is called. HeifContext::get_track() in libheif/context.cc executes assert(has_sequence()) before its normal error handling, so assert-enabled builds abort instead of allowing the public wrapper in libheif/api/libheif/heif_sequences.cc to return null. In release builds, removing the assertion lets the track_id zero path dereference m_tracks.begin()->second on an empty map, which is undefined behavior and typically crashes. The issue is reachable through documented public APIs after parsing attacker-controlled bytes. This issue is fixed in version 1.23.1.

AnalysisAI

Denial-of-service in libheif 1.23.0 and earlier crashes host processes when a crafted HEIF sequence file - accepted by heif_context_read_from_memory() - leaves the context with no registered sequence tracks and heif_context_get_track() is subsequently called. Debug builds abort on assert(has_sequence()) in HeifContext::get_track(); release builds reach undefined behavior by dereferencing m_tracks.begin()->second on an empty std::map, which typically causes a segfault. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Persist
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires that the target application links against libheif 1.23.0 or earlier, passes attacker-controlled bytes to heif_context_read_from_memory() or an equivalent file-reading entry point, and subsequently calls heif_context_get_track() on the resulting context without first confirming track presence via heif_context_has_sequence(). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The vendor-assigned CVSS 3.1 base score of 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) accurately describes the common case where a human user opens a crafted file. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Upgrade libheif to version 1.23.1, which replaces assert(has_sequence()) with a proper heif_error_Usage_error return that the public API wrapper correctly propagates as null from heif_context_get_track(). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

Same weakness CWE-617 – Reachable Assertion

View all
CVE-2025-15684 MEDIUM POC
5.5
CVE-2016-8864 HIGH
7.5
CVE-2020-12417 HIGH POC
8.8
CVE-2020-6623 HIGH POC
8.8
CVE-2020-6619 HIGH POC
8.8
CVE-2020-6617 HIGH POC
8.8
CVE-2023-37023 HIGH POC
8.6
CVE-2023-37021 HIGH POC
8.6

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Module for Desktop Applications 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP7 Fixed
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected

Share

CVE-2026-62377 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy