libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF sequence accepted by heif_context_read_from_memory() can leave the context with no registered sequence tracks and crash when heif_context_get_track(ctx, 0) is called. HeifContext::get_track() in libheif/context.cc executes assert(has_sequence()) before its normal error handling, so assert-enabled builds abort instead of allowing the public wrapper in libheif/api/libheif/heif_sequences.cc to return null. In release builds, removing the assertion lets the track_id zero path dereference m_tracks.begin()->second on an empty map, which is undefined behavior and typically crashes. The issue is reachable through documented public APIs after parsing attacker-controlled bytes. This issue is fixed in version 1.23.1.
CVSS Details
- CVSS 3.1 Base Score: 4.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Ubuntu | — | Upgrade libheif-plugin-ffmpegdecUpgrade libheif-plugin-aomencUpgrade libheif-plugins-allUpgrade libheif-plugin-libde265Upgrade libheif-plugin-jpegencUpgrade libheif-plugin-x265Upgrade heif-thumbnailerUpgrade libheif-plugin-dav1dUpgrade libheif-plugin-rav1eUpgrade libheif-plugin-j2kdecUpgrade heif-gdk-pixbufUpgrade heif-viewUpgrade libheif1Upgrade libheif-plugin-jpegdecUpgrade libheif-devUpgrade libheif-plugin-j2kencUpgrade libheif-plugin-aomdecUpgrade libheif-plugin-svtencUpgrade libheif-plugin-kvazaar | Sep 17, 2026 | Sep 16, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub