Wordfence says its Argus research tool found a critical flaw in libheif, a system library many servers use to open HEIC photos, the format iPhones save pictures in by default. This isn’t a WordPress plugin problem. It sits below WordPress, in software your operating system or host installs.

What happened

libheif maintainer Dirk Farin rated the flaw 9.8 out of 10 on the CVSS severity scale and singled it out in the release notes as critical. A specially crafted HEIC image can make the library write data past the end of a memory buffer. On a vulnerable server, that can expose files the image-processing process can read, or let an attacker run code with that process’s permissions.

Wordfence reported the bug to the libheif project, which fixed it in version 1.23.3, released September 1. Version 1.23.2 and earlier remain vulnerable. Wordfence tested nine real-world configurations and found the official WordPress Docker image among them was vulnerable.

Because libheif is a system library, there’s no WordPress plugin to update. Whether you’re exposed depends on which libheif version your server runs and how it was built, not on anything in your WordPress dashboard.

What to do

  1. Ask your hosting provider whether their servers have updated libheif past version 1.23.2. Most managed WordPress hosts patch system libraries on your behalf.
  2. If you manage your own server, update libheif through your operating system’s package manager.
  3. If your site runs in a container, rebuild and redeploy it from an updated base image. Rebuilding alone won’t help if the base image itself is outdated.

End of article