As cited
Copy frozen at (site build).
vulnerabilities
Wordfence Argus Discovers Critical Vulnerability in libheif, the Library That Opens iPhone Photos on Your Server
Wordfence Argus discovered a critical heap buffer overflow in libheif versions 1.18.0 through 1.23.2, a widely used library that decodes HEIC and HEIF images on servers. The vulnerability allows a crafted image to write attacker-controlled data beyond a memory buffer, potentially enabling arbitrary file read or remote code execution, and was fixed in version 1.23.3 released on September 1, 2026. WordPress sites are exposed when they process untrusted HEIC uploads through the PHP Imagick extension and ImageMagick integration with an affected libheif build, though vulnerability depends on specific build configuration rather than version number alone.
Why it matters: Server operators and hosting providers must urgently patch libheif to prevent remote code execution through untrusted image uploads on WordPress sites and other applications (photo services, media servers, document pipelines) that process HEIC or HEIF files; the critical CVSS 9.8 vulnerability can be tailored to specific environments quickly, making high-value targets and standardized hosting fleets particularly at risk.
- Source published
- First seen by Cybersecurity Tracker