CVE-2026-62377 strukturag CVE debrief

Who should care

Defenders responsible for systems handling HEIF and AVIF files, developers using libheif, and teams managing software dependencies should assess exposure and prioritize updating libheif to version 1.23.1 or later. They should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Additionally, they should plan vendor-supported updates or mitigations through normal change control where exposure is Ass

Why it matters

Defenders should prioritize verifying and updating libheif to version 1.23.1 or later, especially in systems handling HEIF and AVIF files, due to potential crashes or issues with libheif.

• Potential crashes or issues with libheif
• Need to verify and update libheif to version 1.23.1 or later
• Possible security concerns with HEIF and AVIF file processing

Technical summary

libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF sequence accepted by heif_context_read_from_memory() can leave the context with no registered sequence tracks and crash when heif_context_get_track(ctx, 0) is called. HeifContext::get_track() in libheif/context.cc executes assert(has_sequence()) before its normal error handling, so assert-enabled builds abort instead of allowing the public wrapper in libheif/api/libheif/heif_sequences.cc to return null. In release builds, removing the assertion lets the track_id zero path dereference m_tracks.begin()->second on an empty map, which is undefined behavior and typically crashes.

Defensive priority

Defenders should prioritize verifying and updating libheif to version 1.23.1 or later, especially in systems handling HEIF and AVIF files.

Recommended defensive actions

• Verify and update libheif to version 1.23.1 or later
• Review and update systems handling HEIF and AVIF files
• Monitor for potential crashes or issues with libheif
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The issue is reachable through documented public APIs after parsing attacker-controlled bytes. The fix is available in version 1.23.1. The vulnerability is triggered when a specially crafted HEIF sequence is accepted by heif_context_read_from_memory(), which can leave the context with no registered sequence tracks. When heif_context_get_track(ctx, 0) is called, it results in a crash. The crash occurs because HeifContext::get_track() in libheif/context.cc executes assert(has_sequence()) before its normal error handling. In assert- In

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.