libheif Image Library Flaws Expose Ubuntu LTS Systems to DoS and Code Execution
Multiple vulnerabilities in the libheif library affect several Ubuntu LTS versions, potentially allowing denial of service or arbitrary code execution through malicious image files.
TL;DR
- Two vulnerabilities found in libheif affect multiple Ubuntu LTS releases including 18.04, 20.04, 22.04, and 24.04
- CVE-2026-62289 allows remote attackers to trigger denial of service via crafted image transforms
- CVE-2026-62291 impacts Ubuntu 24.04 specifically and may lead to code execution or denial of service
- Systems using libheif for HEIF image processing should apply updates immediately
- Organizations running affected Ubuntu versions should prioritize patching to prevent potential exploitation
Security researchers have identified critical vulnerabilities in libheif, a widely-used library for handling HEIF (High Efficiency Image Format) files. These flaws affect multiple Ubuntu Long Term Support releases and could allow remote attackers to crash applications or potentially execute arbitrary code.
The issues stem from improper handling of image data during processing operations. Organizations using Ubuntu systems that process HEIF images should take immediate action to assess their exposure and apply available security patches.
Vulnerability Details
- CVE-2026-62289 affects Ubuntu 18.04 LTS, 20.04 LTS, and 22.04 LTS through incorrect handling of image transforms
- CVE-2026-62291 specifically impacts Ubuntu 24.04 LTS and involves improper image processing that could enable code execution
- Both vulnerabilities can be triggered remotely by supplying specially crafted HEIF image files
- Successful exploitation could result in application crashes or unauthorized code execution in the context of the vulnerable process
Impact and Recommendations
- Applications using libheif for image processing on affected Ubuntu versions are potentially vulnerable
- Attackers could exploit these flaws without authentication by submitting malicious image files
- System administrators should update libheif packages to version 1.18.2+dfsg-3ubuntu0.1 or later
- Organizations processing user-submitted HEIF images should implement additional input validation and sandboxing
- Review all image processing workflows to identify potential attack surfaces involving HEIF format handling
Sources
Sources
Security email updates
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.