CyberRota Analysis
AI-GeneratedThe libheif library, used for decoding and encoding HEIF and AVIF file formats, is vulnerable in versions 1.23.0 and earlier due to a flaw in the heif_context_read_from_memory() function that can lead to a crash when accessing an empty track context. This vulnerability can be exploited via public APIs by parsing maliciously crafted HEIF sequences, resulting in undefined behavior and potential application crashes. Organizations utilizing libheif for media processing should prioritize upgrading to version 1.23.1 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF sequence accepted by heif_context_read_from_memory() can leave the context with no registered sequence tracks and crash when heif_context_get_track(ctx, 0) is called. HeifContext::get_track() in libheif/context.cc executes assert(has_sequence()) before its normal error handling, so assert-enabled builds abort instead of allowing the public wrapper in libheif/api/libheif/heif_sequences.cc to return null. In release builds, removing the assertion lets the track_id zero path dereference m_tracks.begin()->second on an empty map, which is undefined behavior and typically crashes. The issue is reachable through documented public APIs after parsing attacker-controlled bytes. This issue is fixed in version 1.23.1.