libheif, a HEIF and AVIF file format decoder and encoder, has a reachable assertion vulnerability (CWE-617) in versions 1.23.0 and earlier. A crafted HEIF sequence accepted by heif_context_read_from_memory() can leave the context without any registered sequence tracks. The function heif_context_get_track(ctx, 0) calls an assertion (assert(has_sequence())) in get_track() before normal error handling. In debug builds, this assertion aborts the program. In release builds, the assertion is removed, but the code dereferences an empty map (m_tracks.begin()->second), causing undefined behavior and typically a crash. This vulnerability is reachable through documented public APIs after parsing attacker-controlled input. The issue is resolved in libheif version 1.23.1.

This vulnerability causes a denial of service through application crashes when processing maliciously crafted HEIF files. There is no impact on confidentiality or integrity. The CVSS 3.1 score is 4.3 (medium severity), reflecting network attack vector, low complexity, no privileges required, user interaction required, unchanged scope, no confidentiality or integrity impact, and availability impact limited to crashes.

Upgrade libheif to version 1.23.1 or later, where this issue is fixed. Until then, avoid processing untrusted HEIF files with vulnerable versions. No other mitigations are specified or required.