Skip to main content

CISA alerts on libheif out-of-bounds flaw causing crashes

Source Decision Insights Threat Desk Published January 20, 2026 Companies 1
Human View Machine View

310th article in the last 90 days, one of 512 articles referencing Cybersecurity and Infrastructure Security Agency (CISA). Previous coverage: CISA alerts on Genshi SSTI leading to RCE (Jan 2026).

Companies mentioned

Best suited for

Seniority
Staff
Job function
Application / Software Development
Persona
Platform / Infrastructure Engineer
Buyer role
Technical Implementer / Administrator
Decision stage
Post Buy
Adoption curve
Early Majority
Industry
Information Technology / Software & Services / IT Services / Internet Services & Infrastructure

Our classification, not the publisher's statement. Best suited for, not only for.

libheif’s uncompressed decoder contains an out-of-bounds memory access vulnerability that can be triggered by a maliciously crafted HEIF image and may cause applications using the library to crash, producing a Denial of Service (DoS) condition.

The issue is tracked as CVE-2025-65586 and represents an out-of-bounds iterator access in libheif’s uncompressed codec. The defect occurs when the decoder processes certain metadata structures in a HEIF file and fails to adequately validate values read from an internal metadata box before performing iterator arithmetic on the underlying data buffer, which can allow the decoder to read past the end of the input buffer and misinterpret unrelated memory as valid metadata, potentially causing a segmentation fault. The vulnerability was introduced in commit 6190b58f (October 3, 2024). Versions v1.19.0 through Versions 1.21.1 are affected by this vulnerbaility. The versions v1.17.6 and earlier are not affected. The issue was fixed in commit f4d9157 (November 5, 2025) and then merged to the version release 1.21.0 at the end of 2025. The problem was discovered through coverage-guided fuzzing using AddressSanitizer-instrumented builds of libheif and was reproducible across standard Linux development environments.

An attacker can exploit this vulnerability by supplying a maliciously crafted HEIF image, causing applications that use libheif to crash; based on current analysis, exploitation is limited to DoS conditions. Potential impacts include unexpected termination of applications that decode HEIF images, crashes in systems that automatically generate previews or thumbnails, and disruption of services that process untrusted HEIF content (e.g., browsers, email clients, photo management tools). There is no evidence at this time that this vulnerability can be used to achieve memory disclosure or arbitrary code execution.

Software vendors and developers using the libheif library are strongly encouraged to update to version 1.21.0 or later, which includes the fix for this vulnerability; end users should apply available software updates to ensure they are running a version of libheif that addresses this issue.

Vendors, developers, and end users are advised to install libheif version 1.21.0 or later and to apply any relevant software updates to replace affected releases with versions that contain the commit f4d9157 fix.

Blog post, originally published by Timur Snoke at kb.cert.org.

Mentions

Structured data (JSON-LD)

The schema.org markup this page publishes for search engines and AI agents, exactly as they read it.

[
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#website",
    "@type": "WebSite",
    "name": "Decision Insights",
    "potentialAction": {
      "@type": "SearchAction",
      "target": {
        "@type": "EntryPoint",
        "urlTemplate": "https://decisioninsights.ai/search/?q={search_term_string}&submit=1"
      }
    },
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    },
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#organization",
    "@type": "Organization",
    "contactPoint": {
      "@type": "ContactPoint",
      "contactType": "customer support",
      "email": "[email protected]"
    },
    "description": "Decision Insights is a Registry of technology companies, open source projects, and industry terms, built for people and for AI agents that need sourced, structured information.",
    "logo": {
      "@type": "ImageObject",
      "url": "https://wiretap-cdn-assets.nyc3.cdn.digitaloceanspaces.com/decision-insights/[email protected]"
    },
    "name": "Decision Insights",
    "parentOrganization": {
      "@type": "Organization",
      "name": "Wiretap Labs",
      "sameAs": [
        "https://www.linkedin.com/company/wiretap-labs",
        "https://www.crunchbase.com/organization/wiretap-labs"
      ],
      "url": "https://wiretaplabs.com"
    },
    "publishingPrinciples": "https://decisioninsights.ai/standards/",
    "sameAs": [
      "https://www.linkedin.com/company/decisioninsights"
    ],
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "itemListElement": [
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai",
        "name": "Decision Insights",
        "position": 1
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/records/",
        "name": "Records",
        "position": 2
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/cisa-alerts-on-libheif-out-of-bounds-flaw-causing-crashes/",
        "name": "CISA alerts on libheif out-of-bounds flaw causing crashes",
        "position": 3
      }
    ]
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/cisa-alerts-on-libheif-out-of-bounds-flaw-causing-crashes/#blogposting",
    "@type": "BlogPosting",
    "about": {
      "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/#organization",
      "@type": "Organization",
      "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/",
      "name": "Cybersecurity and Infrastructure Security Agency (CISA)"
    },
    "audience": [
      {
        "@type": "Audience",
        "additionalType": "Seniority",
        "audienceType": "Staff"
      },
      {
        "@type": "Audience",
        "additionalType": "Job function",
        "audienceType": "Application / Software Development"
      },
      {
        "@type": "Audience",
        "additionalType": "Persona",
        "audienceType": "Platform / Infrastructure Engineer"
      },
      {
        "@type": "Audience",
        "additionalType": "Buyer role",
        "audienceType": "Technical Implementer / Administrator"
      },
      {
        "@type": "Audience",
        "additionalType": "Adoption curve",
        "audienceType": "Early Majority"
      },
      {
        "@type": "Audience",
        "additionalType": "Industry",
        "audienceType": "Information Technology / Software & Services / IT Services / Internet Services & Infrastructure"
      }
    ],
    "author": {
      "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
      "@type": "Person",
      "name": "Decision Insights Threat Desk",
      "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
    },
    "dateModified": "2026-08-23T13:10:25-06:00",
    "datePublished": "2026-01-20T14:24:11-07:00",
    "description": "libheif vulnerability CVE-2025-65586 allows a crafted HEIF file to trigger an out-of-bounds read that crashes applications; update to 1.21.0.",
    "headline": "CISA alerts on libheif out-of-bounds flaw causing crashes",
    "isBasedOn": {
      "@type": "CreativeWork",
      "author": {
        "@type": "Person",
        "name": "Timur Snoke"
      },
      "sourceOrganization": {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/",
        "name": "Department of Homeland Security"
      },
      "url": "https://kb.cert.org/vuls/id/481830"
    },
    "keywords": [
      "Denial of Service",
      "Metadata",
      "Software",
      "Vulnerabilities"
    ],
    "mainEntityOfPage": {
      "@id": "https://decisioninsights.ai/cisa-alerts-on-libheif-out-of-bounds-flaw-causing-crashes/",
      "@type": "WebPage",
      "sdDatePublished": "2026-08-23",
      "sdPublisher": {
        "@id": "https://decisioninsights.ai/#organization"
      }
    },
    "mentions": [
      {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/",
        "name": "Cybersecurity and Infrastructure Security Agency (CISA)"
      }
    ],
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    }
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
    "@type": "Person",
    "description": "CISA advisories, vendor security bulletins, and CVE disclosures, summarized into sourced briefs. Produced under our Standards & Methodology.",
    "name": "Decision Insights Threat Desk",
    "sameAs": [
      "https://www.linkedin.com/showcase/decisioninsights/"
    ],
    "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
  }
]

Is this your company? Get structured data for your own pages