What the vulnerability does
01Description
libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, two bugs in libheif chain to leak process heap memory as visible pixel values in decoded grid images. An attacker who uploads a crafted AVIF/HEIC file to any server-side image processor (WordPress, Sharp/libvips, ImageMagick, etc.) can recover heap data - including library function pointers sufficient to defeat ASLR, or any other secret - from the publicly-downloadable transcoded JPEG/PNG/WebP output. Local attack vectors are also possible. Version 1.22.0 fixes the issue.
Explanation of Vulnerability in Simple Terms
02Summary
libheif versions before 1.22.0 expose sensitive information through improper handling of image data. An attacker with network access can read confidential information from the application without authentication or user interaction. The vulnerability does not allow modification or disruption of service, but information disclosure is complete.
What an attacker can do
03Attacker Capabilities
Read sensitive information from the application over the network without authentication.
Potential impact on your site
04Site Impact
If your site uses libheif for image processing, attackers can extract confidential data from processed images or application memory.
Conditions required to exploit
05Prerequisites
Network access to a system running the vulnerable libheif library; no authentication required.
Key dates
06Disclosure timeline
July 21, 2026
CVE published
