SB20261001139 - Ubuntu update for libheif
Published: October 1, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 2 vulnerabilities.
1) Out-of-bounds write (CVE-ID: CVE-2026-62291)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause memory corruption.
The vulnerability exists due to out-of-bounds write in unc_encoder_component_interleave::encode_tile when re-encoding a decoded image with mismatched primary and auxiliary alpha plane dimensions. A remote attacker can trick the victim into opening a specially crafted HEIF sequence file and re-encoding the decoded frame to cause memory corruption.
User interaction is required to open a crafted file, and exploitation occurs through a decode and re-encode workflow using the public APIs.
2) Reachable assertion (CVE-ID: CVE-2026-62377)
CWE-ID: CWE-617 - Reachable Assertion
CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to reachable assertion in HeifContext::get_track() when processing a crafted HEIF sequence file that is accepted with no registered sequence tracks. A remote attacker can trick the victim into opening a crafted file to cause a denial of service.
User interaction is required to open or process the crafted HEIF file. In builds with assertions disabled, the issue may instead lead to undefined behavior due to dereferencing an empty track map.
Remediation
Install update from vendor's website.