Threats Tagged 'cve-2026-62377'

Multiple security vulnerabilities were fixed in libheif version 1.23.1, including integer underflow, heap out-of-bounds write, out-of-bounds read, and assertion abort issues. These flaws affect the handling of HEIF image files and the uncompressed encoder, potentially leading to memory corruption or application crashes. The update also includes several functional improvements and bug fixes unrelated to security.

A reachable assertion vulnerability exists in libheif versions 1.23.0 and earlier. When processing crafted HEIF sequences via heif_context_read_from_memory(), the context may end up with no registered sequence tracks, causing a crash when heif_context_get_track(ctx, 0) is called. This occurs because an assertion in get_track() aborts in debug builds, while release builds dereference an empty map leading to undefined behavior and typical crashes. The issue is fixed in version 1.23.1.

CVE-2026-62289 is an integer underflow vulnerability in the strukturag libheif library versions 1.23.0 and earlier. It occurs when processing a crafted HEIF or AVIF file containing a clean aperture box, which can cause image dimensions to reduce to zero and lead to crashes or corrupted tiling results. The issue arises from applying a transformation twice, causing an underflow in image dimension calculations. This vulnerability is fixed in version 1.23.1.