libheif EUVD-2026-62187

Exploitation conditions cannot be confirmed from available data - no CVSS vector, CWE, or detailed description is present. Based on the nature of libheif as an image parsing library, exploitation would likely require the target system or application to process an attacker-controlled HEIF/HEIC image file. Whether this requires authenticated submission, a specific application feature to be enabled, or a particular Alpine Linux configuration is unknown. Authentication requirements are not confirmed from available data. Defenders should assess which services on Alpine Linux systems invoke libheif with externally-supplied input.

Risk cannot be reliably quantified from available data. No CVSS score or vector is present, meaning attack vector, complexity, privilege requirements, and impact scope are all unconfirmed. No EPSS score is available to estimate exploitation probability. The vulnerability is not listed in the CISA KEV catalog, and no public exploit or POC has been identified at time of analysis. The sole confirmed signal is a vendor-released patch from Alpine Linux. Without CVSS, CWE, or a detailed advisory, this cannot be compared against other priorities with confidence. Security teams should treat this as low-to-moderate urgency pending further vendor disclosure, while prioritizing patch application for systems that process untrusted HEIF/HEIC image content.

An attacker could potentially supply a malformed HEIF or HEIC image file to a system or application running a vulnerable version of libheif on Alpine Linux, triggering the underlying flaw during image parsing. The realistic attack surface depends on how the application exposes libheif - web upload endpoints, messaging platforms, or media processing pipelines accepting user-supplied images represent likely vectors. No public exploit or POC exists at time of analysis, limiting immediate weaponization risk.