libheif EUVD-2026-83024

Exploitation requires that the target application links against libheif 1.23.1 (or an equivalently patched build) and processes a crafted HEIF/HEIC image provided by the attacker. On the client side, a user must open or preview the malicious file; on the server side (e.g., a media transcoding pipeline), no user interaction is needed beyond the attacker being able to submit the file for processing. No special authentication to libheif itself is required - the vulnerability is in the parsing logic. The limiting factor is the ability to deliver a HEIC file to a processing context; applications that reject HEIC input or validate file type before invoking libheif are not exposed.

No CVSS vector or score is provided in the input data, so quantitative risk signals are limited. Qualitatively, out-of-bounds reads in image-parsing libraries carry a moderately elevated real-world risk profile: they are reachable via untrusted file input (a network-attacker-controlled image sent to any consuming application), require no authentication at the library level, but do require user interaction or server-side processing of a crafted file (UI:R in practice). The incomplete-fix nature of this CVE is an important escalation signal - the vendor attempted a repair and missed coverage, meaning defenders who applied the GHSA-73p7-m7gg-w2jv fix may believe they are protected when they are not. No EPSS score, KEV listing, or POC is available to assess exploitation probability. The primary concern is crash-based denial of service and potential heap-layout information leakage that could assist a follow-on memory-corruption exploit in a chained attack, though direct code execution from an OOB read alone is unlikely without a separate write primitive.

An attacker crafts a malicious HEIC image file containing malformed metadata or data-block length values that bypass the incomplete fix in 1.23.1 and trigger an out-of-bounds memory read. The file is delivered to a victim via email attachment, web upload, or messaging application, and the vulnerable application processes it - either on the client or server side. The result is an application crash (denial of service) or, in a more sophisticated chained attack, disclosure of heap memory that aids further exploitation.