Description
libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, two bugs in libheif chain to leak process heap memory as visible pixel values in decoded grid images. An attacker who uploads a crafted AVIF/HEIC file to any server-side image processor (WordPress, Sharp/libvips, ImageMagick, etc.) can recover heap data - including library function pointers sufficient to defeat ASLR, or any other secret - from the publicly-downloadable transcoded JPEG/PNG/WebP output. Local attack vectors are also possible. Version 1.22.0 fixes the issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| strukturag | libheif | < 1.22.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libheif | 1.23.1-1 | — |
| Debian 13 | libheif | 1.19.8-1+deb13u1 | — |
| Debian 12 | libheif | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | libheif | 1.21.2-3ubuntu0.1 | — |
| Ubuntu 25.10 | libheif | 1.20.2-1ubuntu0.4 | — |
| Ubuntu 24.04 LTS | libheif | 1.17.6-1ubuntu4.4 | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 22.04 LTS | libheif | 1.12.0-2ubuntu0.1~esm3 | — |
| Ubuntu Pro 20.04 LTS | libheif | 1.6.1-1ubuntu0.1~esm3 | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | libheif | 1.23.0-150700.3.15.1 | SUSE-SU-2026:2622-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | libheif | 1.23.0-160000.1.1 | SUSE-SU-2026:22153-1 |
| SLES 16.0 | libheif | 1.23.0-160000.1.1 | SUSE-SU-2026:22153-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | libheif | 1.22.2-1.1 | openSUSE-SU-2026:10878-1 |
| openSUSE Leap 16.0 | libheif | 1.23.0-160000.1.1 | openSUSE-SU-2026:20974-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | libheif +3 | 1.19.8-1.amzn2023.0.7 | ALAS2023-2026-1971 |
Advisories 5
- ALAS2023-2026-1971 Important: libheif security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jul 20, 2026
- SUSE-SU-2026:2622-1 Security update for libheif SUSE / openSUSE Security Updates · Jun 25, 2026
- openSUSE-SU-2026:20974-1 Security update for libheif SUSE / openSUSE Security Updates · Jun 24, 2026
- SUSE-SU-2026:22153-1 Security update for libheif SUSE / openSUSE Security Updates · Jun 24, 2026
- openSUSE-SU-2026:10878-1 gdk-pixbuf-loader-libheif-1.22.2-1.1 on GA media SUSE / openSUSE Security Updates · May 29, 2026