CVE-2026-62377: strukturag libheif Reachable Assertion

Vulnerability summary

CVE-2026-62377 is a medium (CVSS 4.3) Reachable Assertion vulnerability in strukturag libheif. EPSS estimates a 0.41% chance of exploitation in the next 30 days, higher than 34.2% of scored vulnerabilities.

Timeline

1. 18-08-2026
   PublishedVulnerability first disclosed.
2. 19-08-2026
   Last modifiedVulnerability information updated.

Description

libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF sequence accepted by heif_context_read_from_memory() can leave the context with no registered sequence tracks and crash when heif_context_get_track(ctx, 0) is called. HeifContext::get_track() in libheif/context.cc executes assert(has_sequence()) before its normal error handling, so assert-enabled builds abort instead of allowing the public wrapper in libheif/api/libheif/heif_sequences.cc to return null. In release builds, removing the assertion lets the track_id zero path dereference m_tracks.begin()->second on an empty map, which is undefined behavior and typically crashes. The issue is reachable through documented public APIs after parsing attacker-controlled bytes. This issue is fixed in version 1.23.1.

• CWE-617Reachable AssertionThe product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
• CWE-908Use of Uninitialized ResourceThe product uses or accesses a resource that has not been initialized.