CVE-2025-65586: Libheif Flaw Exposes Image Decoders to Denial-of-Service

CVE-2025-65586 is a newly disclosed flaw in libheif, the open‑source library used for decoding modern image formats, which can cause applications to crash simply by processing a malicious image. The vulnerability lies in the library’s uncompressed decoder component and is triggered when the decoder processes specific metadata structures, allowing it to read past the end of the input buffer due to inadequate boundary checks.

According to CERT vulnerability note, the issue stems from the decoder failing to adequately validate values read from an internal metadata box before performing iterator arithmetic on the underlying data buffer. The impact is rated as a Denial of Service, with potential for unexpected termination of image decoders, crashes in systems generating previews or thumbnails, and disruption of services that process untrusted HEIF content.

There is no evidence at this time that it enables memory disclosure or arbitrary code execution, the risk being mainly stability‑based. Vendors have addressed the flaw, and users are urged to update to libheif version 1.21.0 or later, with the fix included in that release. 21 January 2026.