Imagine sending an image file to be processed on a server, only to have that file accidentally reveal sensitive information hidden deep within the server\u2019s memory. That’s precisely the risk posed by a critical vulnerability recently discovered in libheif, a popular software library used for decoding and encoding HEIF and AVIF image formats. This flaw could allow attackers to steal confidential data, including crucial system details, just by uploading a specially crafted image.<\/p>\n
This vulnerability is identified as CVE-2026-47247. It was publicly disclosed on July 21, 2026, and its status is currently “Analyzed.” With a CVSS score of 7.5, it is classified as a High severity issue, indicating a significant risk to affected systems.<\/p>\n
The core of this vulnerability lies within the libheif<\/strong> library, specifically versions prior to 1.22.0. Because libheif is widely used by many applications for handling modern image formats like AVIF and HEIC, the impact extends to a broad range of software and services. Confirmed affected applications include:<\/p>\n Additionally, other applications that rely on libheif through various image processing stacks are likely affected. These could include imgproxy, Ruby on Rails Active Storage (especially those using libvips since Rails 7), Mastodon, and even cloud image processing services like Cloudinary and Shopify. Desktop image editors such as GIMP, Krita, and darktable are also potentially at risk.<\/p>\n The vulnerability, CVE-2026-47247, has been fully analyzed. This means security experts have thoroughly understood the nature of the flaw, how it can be exploited, and its potential impact. Fixes have been developed and released by the maintainers of libheif.<\/p>\n Rated as High severity with a CVSS score of 7.5, this vulnerability represents a serious threat. The ability to leak heap memory as visible pixel values in a decoded image is particularly dangerous. This heap data can contain sensitive information, including memory addresses (which could help bypass Address Space Layout Randomization, or ASLR, a security feature designed to make exploits harder) or other confidential secrets stored in memory. An attacker could remotely exploit this by simply uploading a malicious AVIF or HEIC file to a server that processes images with a vulnerable libheif version and then downloading the processed output (e.g., a JPEG or PNG thumbnail) to extract the hidden data. No special privileges or user interaction are required for a successful attack, making it highly potent.<\/p>\n The good news is that fixes are available. The primary solution is to update libheif to version 1.22.0 or later<\/strong>. This update addresses the two underlying bugs that allowed this information leak:<\/p>\n System administrators and developers should prioritize updating libheif in any environment where it is used, especially on server-side image processing systems. If direct updating is not immediately possible, closely monitor any image uploads and their processing, although this is a reactive measure.<\/p>\n https:\/\/github.com\/strukturag\/libheif\/security\/advisories\/GHSA-2vh6-whr3-cmq3<\/p>\n","protected":false},"excerpt":{"rendered":" Imagine sending an image file to be processed on a server, only to have that file accidentally reveal sensitive information hidden deep within the server\u2019s memory. That’s precisely<\/p>\n","protected":false},"author":17,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[1341,1339,1338,1340,1337],"class_list":["post-4361","post","type-post","status-publish","format-standard","hentry","category-security","tag-avif","tag-heap-memory-leak","tag-heic","tag-image-processing","tag-libheif"],"yoast_head":"\n\n
Current Status<\/h2>\n
Severity Level<\/h2>\n
Possible Solutions<\/h2>\n
\n
References<\/h2>\n