libheif CVE-2025-68431

MEDIUM

N/A vendor:alpine

Information Disclosure

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 22:47 vuln.today

DescriptionCVE.org

Alpine Linux: libheif fixed in 1.21.2-r0

AnalysisAI

libheif, a library for reading and writing HEIF and AVIF image files, received a security fix in Alpine Linux package version 1.21.2-r0. The specific vulnerability class, impact, and exploitation method are not described in available intelligence - the CVE record contains only a changelog-style fix notice from the Alpine Linux vendor. With an EPSS score of 0.04% (14th percentile), automated exploitation at scale is considered unlikely based on current threat intelligence signals, though the absence of CVSS data prevents a complete risk characterization. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog.

Technical ContextAI

libheif is an open-source C++ library used for decoding and encoding HEIF (High Efficiency Image File Format) and AVIF images, commonly embedded in applications handling modern image formats from Apple devices and web content. It is packaged in Alpine Linux as a shared library dependency. The root cause class (CWE) has not been disclosed in available data - common vulnerability classes in image-parsing libraries include heap buffer overflows, use-after-free, integer overflows, and out-of-bounds reads triggered by malformed image files, but no such classification is confirmed for this CVE. CPE strings are not provided, so exact affected upstream libheif versions prior to the Alpine fix cannot be confirmed from available data alone.

Affected ProductsAI

The affected product is libheif as packaged in Alpine Linux, fixed in Alpine package version 1.21.2-r0. The specific upstream libheif library version range that is vulnerable is not identified in available data. No CPE strings are provided. Other Linux distributions or operating systems that package libheif independently may also be affected but are not addressed by this CVE record, which is scoped to the Alpine Linux vendor advisory. No vendor advisory URL was included in the reference data.

RemediationAI

Alpine Linux users should upgrade the libheif package to version 1.21.2-r0 or later using the standard Alpine package manager: 'apk upgrade libheif'. This is the only confirmed fix version from available data. No upstream libheif release version is confirmed as the patch baseline, so users of non-Alpine distributions should monitor the libheif upstream project at the official repository for a corresponding security release. No workarounds or compensating controls are described in available intelligence. If immediate patching is not feasible and the system processes untrusted HEIF or AVIF image files (e.g., via a web service or media handler), consider restricting acceptance of those file formats at the application or network layer as a precautionary measure, accepting the trade-off of reduced format support.