Executive brief
libheif is a widely used software library for processing HEIF and AVIF images, commonly utilized by web platforms like WordPress and image processing tools like ImageMagick. A vulnerability in how the library handles image grids allows an attacker to upload a specially crafted image file that, when processed by a server, leaks sensitive information from the server's memory. This leaked data can include secret keys or internal memory addresses used to bypass security protections, potentially facilitating more advanced attacks against the hosting infrastructure.
Technical details
A heap information disclosure vulnerability exists in libheif due to the chaining of two flaws: uninitialized pixel plane allocation and an incorrect grid coverage check. The first flaw (CWE-908) occurs in `pixelimage.cc` where memory is allocated without zero-initialization, leaving stale heap data in padding and gap regions. The second flaw (CWE-682) in `grid.cc` uses integer division to validate tile sizes, allowing a 'gap' of unwritten pixels if the tiles do not perfectly divide the grid dimensions. An attacker can craft an AVIF/HEIC file where these gap pixels represent raw heap bytes, which are then rendered into the output image (e.g., JPEG/PNG). This allows for the extraction of sensitive data, such as function pointers to defeat ASLR, via remote network vectors (e.g., uploading to a web server) or local vectors. The issue is fixed in version 1.22.0 by zero-initializing allocations and correcting the grid coverage logic.
Affected products
- strukturag libheif < 1.22.0
Timeline
- 2026-05-19: advisory: GitHub Security Advisory published
- 2026-07-21: disclosed: CVE published to NVD
- 2026-07-21: patched: Fix confirmed in version 1.22.0