{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-62377 in the wild and no public exploit code.","fix":"Upgrade to a fixed version.","what":"CVE-2026-62377 is a medium-severity denial of service vulnerability in strukturag libheif, published on 18 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for CVE-2026-62377 and fix it if it is affected.\n\nWhat it is: CVE-2026-62377 is a medium-severity denial of service vulnerability in strukturag libheif, published on 18 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.\nExploitation: There is no known exploitation of CVE-2026-62377 in the wild and no public exploit code.\n\nAffected product: strukturag libheif. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-62377/ (Markdown: https://insights.sbomify.com/CVE-2026-62377/index.md)","id":"CVE-2026-62377","markdown":"https://insights.sbomify.com/CVE-2026-62377/index.md","name":"CVE-2026-62377","record":{"aliases":["BELL-CVE-2026-62377","DEBIAN-CVE-2026-62377","GHSA-9ww4-9v47-m7pj","MINI-5cf5-4cpw-35m7","UBUNTU-CVE-2026-62377"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"HEIF/AVIF image library","requires_auth":"none","summary":"A crafted HEIF file causes libheif to crash via assertion failure or undefined behavior, leading to denial of service.","user_interaction":"required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[],"cvss":{"score":4.3,"severity":"medium","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","version":"3.1"},"cwes":[{"id":"CWE-908","name":"Use of Uninitialized Resource"},{"id":"CWE-617","name":"Reachable Assertion"}],"description":"libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF sequence accepted by heif_context_read_from_memory() can leave the context with no registered sequence tracks and crash when heif_context_get_track(ctx, 0) is called. HeifContext::get_track() in libheif/context.cc executes assert(has_sequence()) before its normal error handling, so assert-enabled builds abort instead of allowing the public wrapper in libheif/api/libheif/heif_sequences.cc to return null. In release builds, removing the assertion lets the track_id zero path dereference m_tracks.begin()-\u003esecond on an empty map, which is undefined behavior and typically crashes. The issue is reachable through documented public APIs after parsing attacker-controlled bytes. This issue is fixed in version 1.23.1.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Denial of service in libheif","id":"CVE-2026-62377","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"denial_of_service","year":"2026"},"n_packages":0,"n_references":4,"next":{"headline":"RustFS Console: Critical Stored XSS in Preview Modal leading to Administrative Account Takeover","id":"CVE-2026-62378"},"packages":[],"prev":{"headline":"Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access","id":"CVE-2026-62376"},"products":["libheif"],"published":"2026-08-18","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-08-19","vendors":["strukturag"]},"summary":"A crafted HEIF file causes libheif to crash via assertion failure or undefined behavior, leading to denial of service.","url":"https://insights.sbomify.com/CVE-2026-62377/"}