CVE-2026-62377

Name	CVE-2026-62377
Description	libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF sequence accepted by heif_context_read_from_memory() can leave the context with no registered sequence tracks and crash when heif_context_get_track(ctx, 0) is called. HeifContext::get_track() in libheif/context.cc executes assert(has_sequence()) before its normal error handling, so assert-enabled builds abort instead of allowing the public wrapper in libheif/api/libheif/heif_sequences.cc to return null. In release builds, removing the assertion lets the track_id zero path dereference m_tracks.begin()->second on an empty map, which is undefined behavior and typically crashes. The issue is reachable through documented public APIs after parsing attacker-controlled bytes. This issue is fixed in version 1.23.1.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libheif (PTS)	bookworm, bookworm (security)	1.15.1-1+deb12u1	fixed
	trixie	1.19.8-1	fixed
	trixie (security)	1.19.8-1+deb13u1	fixed
	forky, sid	1.23.3-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version
libheif	source	bookworm	(not affected)
libheif	source	trixie	(not affected)
libheif	source	(unstable)	1.23.1-1

Notes

[trixie] - libheif <not-affected> (Vulnerable code not present, introduced in 1.20)
[bookworm] - libheif <not-affected> (Vulnerable code not present, introduced in 1.20)
https://github.com/strukturag/libheif/security/advisories/GHSA-9ww4-9v47-m7pj
https://github.com/strukturag/libheif/issues/1844
Introduced after: https://github.com/strukturag/libheif/commit/fb27472da6692bf7b0efd819eb22c52819aae90c (v1.20.0)
Fixed by: https://github.com/strukturag/libheif/commit/e1a0bc1c1ae74f8075eaca30a1cdb2b9bee698d3 (v1.23.1)