CVE-2026-62377: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-62377 is a reachable assertion vulnerability in strukturag's libheif, a HEIF and AVIF file format decoder and encoder library. A crafted HEIF sequence file accepted by heif_context_read_from_memory() can leave the parsing context with zero registered sequence tracks; subsequently calling heif_context_get_track(ctx, 0) triggers assert(has_sequence()) in HeifContext::get_track() (context.cc:2110), aborting the process. All versions up to and including 1.23.0 are affected; the issue is fixed in v1.23.1. It carries a CVSS v3.1 base score of 4.3 (Medium) (GitHub Advisory, libheif Release).

The root cause is a misplaced assertion (CWE-617: Reachable Assertion) combined with a use of uninitialized/empty resource (CWE-908) in HeifContext::get_track(). The function calls assert(has_sequence()) — which checks that the internal m_tracks map is non-empty — before any error-handling logic runs, preventing the public wrapper heif_context_get_track() from returning the documented nullptr on failure. In assert-enabled (debug) builds, the process aborts with SIGABRT; in NDEBUG (release) builds, the assertion is compiled out and the track_id == 0 code path dereferences m_tracks.begin()->second on an empty std::map, which is undefined behavior and typically crashes. The vulnerability is reachable through the documented public C API sequence heif_context_alloc → heif_context_read_from_memory → heif_context_get_track(ctx, 0) with no special privileges. A 743-byte proof-of-concept HEIF file (ftyp brand msf1, malformed/empty sample tables) is publicly available in the security advisory (GitHub Advisory, GitHub Issue).

Successful exploitation results in a denial-of-service condition — the host process consuming libheif aborts or crashes when it attempts to process a specially crafted HEIF sequence file. There is no memory corruption, no confidentiality loss, and no integrity impact; the vulnerability is limited to availability of the affected application. Any application or service that parses attacker-supplied HEIF/AVIF files using libheif ≤ 1.23.0 and subsequently queries sequence tracks is at risk of process termination (GitHub Advisory).

A public proof-of-concept (a 743-byte crafted HEIF file with base64-encoded bytes) is included in the GitHub security advisory and issue report, making exploitation straightforward for anyone able to supply a file to a vulnerable application. Exploitation requires user interaction (a user or service must open/process the malicious file), which limits the attack surface somewhat. No in-the-wild exploitation has been reported, no threat actor attribution exists, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is 0.0, reflecting low current exploitation probability (GitHub Advisory, Feedly).

1. Craft the malicious file: Use the publicly available base64-encoded 743-byte PoC HEIF file from the security advisory. The file declares ftyp major brand msf1 (HEIF image sequence) and contains a moov/trak structure with malformed/empty sample tables that passes parsing but registers zero sequence tracks.
2. Deliver the file: Provide the crafted .heif file to a target application that uses libheif ≤ 1.23.0 to parse HEIF/AVIF files — for example, an image viewer, media transcoder, or web service accepting user-uploaded images.
3. Trigger parsing: The application calls heif_context_read_from_memory() (or equivalent file-reading API), which returns heif_error_Ok — accepting the file without error — but leaves the context with an empty track map (has_sequence() == false).
4. Trigger the crash: The application subsequently calls heif_context_get_track(ctx, 0) to retrieve the first visual track. This routes into HeifContext::get_track(), where assert(has_sequence()) fires (debug builds: SIGABRT) or m_tracks.begin()->second is dereferenced on an empty map (release builds: undefined behavior/crash), terminating the process (GitHub Advisory, GitHub Issue).

• Process: Unexpected process termination (SIGABRT or segmentation fault) in applications using libheif when processing HEIF/AVIF files; crash dumps referencing HeifContext::get_track() at context.cc:2110 or heif_context_get_track in heif_sequences.cc:88.
• Logs: Application error logs showing assertion failure messages such as Assertion 'has_sequence()' failed from libheif; AddressSanitizer output referencing ABRT on unknown address with stack frames in HeifContext::get_track.
• File System: Presence of small (~743-byte) HEIF files with ftyp brand msf1 and malformed/empty moov/trak structures in upload directories or temporary processing folders.
• Network: Repeated submission of small HEIF files (particularly those with msf1 ftyp brand) to image-processing endpoints, especially if followed by service restarts or error responses (GitHub Advisory).

Upgrade libheif to version 1.23.1, which replaces the assert(has_sequence()) call in HeifContext::get_track() with a proper error return, allowing the public wrapper to return nullptr as documented. The fix was applied in commit e1a0bc1c1ae74f8075eaca30a1cdb2b9bee698d3. SUSE has also issued a security update (SUSE-SU-2026:3597-1) for affected distributions. As a workaround where upgrading is not immediately possible, applications can validate that heif_context_has_sequence() returns non-zero before calling heif_context_get_track() (libheif Release, GitHub Commit, SUSE Advisory).

The vulnerability was discovered and reported by Aisle Research (Ze Sheng of O2Lab & TAMU, Dmitrijs Trizna, Luigino Camastra, and Guido Vranken), and was accepted and fixed by the libheif maintainers promptly. SUSE issued a security update for its distributions shortly after the advisory was published. The issue was noted on Bluesky via the CVE feed and indexed by multiple vulnerability tracking services, but generated no significant broader community discussion given its moderate severity and limited impact (GitHub Advisory, SUSE Advisory).