USN-9012-1: libheif vulnerability

Q: Who is exposed to this issue?

Users or automated systems that open HEIF images using the affected Ubuntu libheif package may be exposed. The issue can be triggered by a specially crafted HEIF file.

Q: What does an attacker need to exploit it?

An attacker needs to cause a user or automated system to open a specially crafted HEIF image. The provided information does not indicate that network access or prior authentication is required.

Q: What is the potential impact?

Successful exploitation could allow arbitrary code execution.

Published Nov 9, 2026

Updated

Alex Thomas discovered that libheif incorrectly handled certain HEIF images. An attacker could possibly use this issue to execute arbitrary code if a user or automated system were tricked into opening a specially crafted file.

Affected Software

1 affected componentFixes available

ubuntu/libheif<1.21.2-3ubuntu0.7

1.21.2-3ubuntu0.7

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/libheif to a version that resolves this vulnerability.
Fixed in 1.21.2-3ubuntu0.7

Event History

Nov 9, 2026

Advisory Published

via OSV·04:44 PM

Data Sourced

via OSV·04:44 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

Who is exposed to this issue?

Users or automated systems that open HEIF images using the affected Ubuntu libheif package may be exposed. The issue can be triggered by a specially crafted HEIF file.

What does an attacker need to exploit it?

An attacker needs to cause a user or automated system to open a specially crafted HEIF image. The provided information does not indicate that network access or prior authentication is required.

What is the potential impact?

Successful exploitation could allow arbitrary code execution.

USN-9012-1: libheif vulnerability

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What is the potential impact?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What is the potential impact?