Wordfence Argus Discovers Critical Vulnerability in libheif, the Library That Opens iPhone Photos on Your Server
Wordfence Argus found a critical CVSS 9.8 vulnerability in libheif, a library many servers use to process HEIC images. We demonstrated protected-file disclosure and code execution on one exact WordPress deployment. Exploitation is target-specific, but HEIF Heist shows that adapting image exploits to real systems is practical.
On September 1, 2026, the libheif project released version 1.23.3, closing a critical heap buffer overflow that the Wordfence Threat Intelligence team, using Wordfence Argus, discovered and reported four days earlier. The libheif maintainer, Dirk Farin, gave it a score of 9.8 out of 10 on the CVSS scale, with the release notes singling it out: “One of the fixed issues is rated critical, so all users are strongly advised to upgrade.” The bug lets a crafted HEIC image write attacker-chosen data past the end of a memory buffer. On a vulnerable server, that can lead to reading files the image-processing worker can access or running code with its permissions.
If you run a WordPress site, there isn’t a WordPress plugin to update for the usual image-processing path. libheif is a system library, so most site owners will get the fix through their operating system or hosting provider. Containerized sites need to be rebuilt and redeployed from an updated base image. Whether you’re exposed depends on both the libheif version and how it was built. We tested nine real configurations on September 5, and the official WordPress Docker image we tested was one of the vulnerable ones.