Critical Heap Overflow in libheif Library Exposes Servers Processing iPhone Photos
A critical heap buffer overflow vulnerability (CVSS 9.8) discovered in the libheif library, used for processing HEIC images like those from iPhones, could lead to file disclosure or code execution.
The libheif project has released version 1.23.3 to address a critical heap buffer overflow vulnerability, rated CVSS 9.8, discovered by Wordfence Threat Intelligence. This flaw allows a specially crafted HEIC image to overwrite memory beyond its intended buffer, potentially leading to the disclosure of sensitive files or the execution of arbitrary code with the permissions of the image processing worker.
The vulnerability affects a wide range of applications and services that rely on vulnerable builds of libheif for processing HEIC and HEIF image formats. This includes not only server-side applications but also desktop image viewers, photo galleries, and media servers. Notably, the official WordPress Docker image was found to be vulnerable in testing conducted by Wordfence.
Libheif is a crucial system library for handling the HEIC format, which has been the default for iPhones since 2017 due to its efficiency. While users may not interact with libheif directly, applications like WordPress utilize it indirectly. When a user uploads an image, WordPress's PHP Imagick extension, through ImageMagick, can pass the file to libheif for processing, placing a C++ library with the worker's permissions in a position to parse untrusted data from the internet.
Exploitation of this vulnerability is not trivial and is target-specific, requiring attackers to craft malicious images tailored to the specific libheif build and server environment. Modern security defenses like ASLR and RELRO make memory corruption bugs harder to exploit for full system compromise. However, Wordfence demonstrated that on a specific WordPress setup running Debian and glibc, the vulnerability could be leveraged to read protected files and execute code.
While the exploit requires effort, the potential impact is severe. A CVSS score of 9.8 indicates a high risk, especially in scenarios where servers process images from untrusted sources without robust authentication. The fact that a single successful exploit could potentially affect thousands of identical deployments, such as those using a common hosting image, amplifies the threat.
Users running affected systems are strongly advised to upgrade to libheif version 1.23.3 or later. For WordPress users, this typically means updating system packages or relying on hosting providers for the fix, as it's not a plugin-level update. For containerized environments, rebuilding and redeploying from an updated base image is necessary. Restarting affected services after applying the patch is also crucial.
The discovery highlights the ongoing challenge of securing complex software supply chains. A library designed for efficient image handling on consumer devices can become a critical attack vector when integrated into server infrastructure, underscoring the need for continuous security assessments of all software components, regardless of their perceived obscurity.
This vulnerability serves as a reminder that even seemingly innocuous file formats and libraries can harbor critical security risks. Organizations processing user-uploaded images, especially those from mobile devices, should prioritize patching and verifying the security of their image processing pipelines.