CVE-2026-62377: libheif: Reachable assertion in HeifContext::get_track() aborts on a valid-but-empty HEIF sequence file (context.cc:2110)
libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF sequence accepted by heifcontextreadfrommemory() can leave the context with no registered sequence tracks and crash when heifcontextgettrack(ctx, 0) is called. HeifContext::gettrack() in libheif/context.cc executes assert(hassequence()) before its normal error handling, so assert-enabled builds abort instead of allowing the public wrapper in libheif/api/libheif/heifsequences.cc to return null. In release builds, removing the assertion lets the trackid zero path dereference mtracks.begin()->second on an empty map, which is undefined behavior and typically crashes. The issue is reachable through documented public APIs after parsing attacker-controlled bytes. This issue is fixed in version 1.23.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
libheifto a version that resolves this vulnerability.Fixed in 1.23.1
Event History
Frequently Asked Questions
Which applications are realistically exposed?
Applications using libheif 1.23.0 or earlier are exposed if they parse attacker-controlled HEIF sequence data with heif_context_read_from_memory() and subsequently call heif_context_get_track(ctx, 0). The issue is reachable through documented public APIs and does not require attacker privileges, but it does require user interaction according to the supplied severity vector.
What conditions are needed to trigger the crash?
A crafted but valid empty HEIF sequence file can cause the parsed context to contain no registered sequence tracks. Calling heif_context_get_track(ctx, 0) afterward triggers an assertion abort in assertion-enabled builds; release builds can dereference an empty track map and typically crash.
What is the remediation?
Update libheif to version 1.23.1, which fixes the issue. The provided information does not specify an alternative mitigation for deployments that cannot yet update.