Security Advisory: libheif Vulnerabilities in Ubuntu 25.10
Recent security findings have identified two significant vulnerabilities in the libheif library, which could lead to denial of service (DoS) conditions in Ubuntu 25.10. These vulnerabilities are detailed in the Ubuntu Security Notice USN-8649-1.
Identified Vulnerabilities
The first vulnerability, documented as CVE-2026-62289, involves an integer underflow in the Fraction constructor when a clap transform is applied twice. This flaw could potentially allow an attacker to exploit the library, leading to a crash and subsequent denial of service.
The second vulnerability, identified as CVE-2026-62292, pertains to an out-of-bounds read during uncompressed tile range slicing. This issue is specific to Ubuntu 25.10 and could similarly result in a crash of the libheif library, causing a denial of service.
Recommended Actions
Organizations and system administrators using Ubuntu 25.10 should take immediate action to mitigate these vulnerabilities. It is advisable to monitor for updates from Ubuntu and apply any available patches as soon as they are released. Regularly reviewing security advisories and implementing recommended security practices can help safeguard systems against potential exploitation.
Follow Cyber Warriors Middle East for further cybersecurity resources, advisories and technical guidance.
