On September 1 the libheif project released version 1.23.3, closing a heap buffer overflow that the Wordfence Threat Intelligence team had reported four days earlier. The library's maintainer, Dirk Farin, scored it 9.8 out of 10 on the CVSS scale and urged every user to upgrade.
The bug lets a crafted HEIC image write attacker-chosen data past the end of a memory buffer. On a vulnerable server, Wordfence turned that into reading files the image-processing worker could reach and running code with that worker's permissions.
The library nobody chose to install
iPhones have produced HEIC files by default since iOS 11 in 2017, and almost nobody writes their own code to open one. Most of the Linux ecosystem settles on libheif, and WordPress reaches it without ever naming it: an upload goes to the PHP Imagick extension, which calls ImageMagick, which recognizes HEIF and hands the file down to libheif. A C++ library ends up inside the PHP worker, parsing bytes that arrived from the internet.
There is no plugin to update here. libheif is a system library, so the fix comes from your operating system or hosting provider. The same library sits under image viewers, media servers, document pipelines and thumbnail services, so the real question is not about WordPress: does your software decode HEIC files that came from somebody else?
The version number does not settle it
Wordfence tested nine real configurations on September 5. Debian 13 and Alpine 3.22 both ship libheif 1.19.8, the same upstream release, and only one is vulnerable: exposure depends on whether the build enabled the uncompressed codec, not on the version string alone. Ubuntu 26.04 and Fedora 44 were also vulnerable; Ubuntu 24.04 LTS, Debian 12 and AlmaLinux 10 were not. The official WordPress Docker image was exposed out of the box.
How far one photo actually gets
Wordfence demonstrated protected-file disclosure and code execution on one exact WordPress deployment running Debian and glibc, using an ordinary Author account, the first WordPress role allowed to upload media. A narrower test that copied the uploaded image into another location worked in 29 of 30 attempts against an Apache server that was already running and reusing worker processes.
That is strong evidence of real impact rather than a universal exploit, and Wordfence says so plainly: the payload depended on the exact libheif build, on how the server managed memory, and on requests reaching a worker in the right state. Wordfence's point is that tailoring is a speed bump rather than a safety control, citing Hacktron's HEIF Heist research, where adapting an attack to a new target generally took one or two days. Fleets built from one shared image are the concern.
Install the system package, then rebuild the containers
Install your operating system or hosting provider's libheif update, or if you install directly, use at least 1.23.3; 1.23.4 is the current upstream security release. Restart PHP and the affected services afterwards, and rebuild containers from an updated base image rather than restarting the old one. WordPress administrators can check Tools, Site Health, Info, Media Handling for whether ImageMagick reports HEIC support at all. If you cannot patch yet, removing heic, heif, heics and heifs from the allowed upload types rejects the file before it reaches the library.
No CVE identifier had been assigned when Wordfence published. The finding came out of Argus, Wordfence's agentic adversarial testing framework, during a WordPress 7.1 assessment led and validated by Alex Thomas. Automated testing keeps surfacing real bugs beneath the application layer: in August an AI agent chained six flaws into a WordPress takeover, and days earlier a booby-trapped image ran code through the same Imagick path. The original report notes that a comment directly above the faulty loop already described a different out-of-bounds write in the same function, patched months earlier.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.