Skip to content

GHSA-2jg2-4ch7-h545 on CTRL-OS 26.05

Aliases: GHSA-2jg2-4ch7-h545

Packages: libheif

Status: Plausible

Advisory Information

Reaching out from Meta's Product Security team. We have received an external report about a working exploit against the latest release of libheif (v1.23.1), where parsing a malformed HEIC image file could lead to malicious code being executed.

We have seen & confirmed a functional RCE proof of concept provided by the external reporter.

Our investigation into the issue uncovered 11 separate vulnerabilities in libheif. We have developed a set of patches to mitigate most of the issues discovered.

All of the discovered vulnerabilities stem from the following incorrect assumption:

Throughout libheif, code assumes that a HeifPixelImage's logical geometry (m_width/m_height) accurately describes every channel plane it holds, and that each heif_channel is backed by at most one plane. Neither invariant is enforced anywhere. Derived items (iden, and auxiliary auxl chains) let an attacker construct images that violate both, and roughly a dozen consumers then index planes using geometry the planes do not have.

Attaching an agent-ingestable ZIP containing:

  • Details of each of the 11 vulnerabilities discovered
  • A proof of concept, where applicable, bundled with each vulnerability
  • A set of patches against v1.23.1 which mitigate a subset of the discovered issues

We are submitting this report under Meta's Vulnerability Disclosure Policy.

Updates

2026-08-25 14:41 CEST

Metadata changes:

  • Status for package libheif: “Plausible”

2026-08-25 14:40 CEST

Metadata changes:

  • Status for package libheif: “New”