Use-after-free in libheif - #VU158753
Published: November 3, 2026
Vulnerability identifier: #VU158753
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-416
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service in applications that decode untrusted HEIF images.
The vulnerability exists due to a heap use-after-free in libheif's derived-image bit-depth queries when decoding grid tiles in parallel. A remote attacker can submit a crafted HEIF image containing derived tiles that share a coded input, causing one thread to access cached decoder data freed by another thread, to crash an image-processing service and deny service.
The vulnerable path executes before codec plugin selection, so exploitation does not require an OpenJPEG decoder plugin.
Affected software
libheif
Remediation
Install security update from vendor's website.
libheif - update to 1.23.7