---
id: 8802
title: "Heap Use-After-Free and Double Free in libheif ImageItem Encoding (GHSA-qwpf-5wf7-r996)"
cvss: 5.9
severity: medium
vendor: "struktur AG"
product: "libheif"
affected_versions: ">= 1.21.0, <= 1.23.4"
source_domain: github.com
source_url: "https://github.com/strukturag/libheif/security/advisories/GHSA-qwpf-5wf7-r996"
published_at: "2026-09-21T18:27:19Z"
tags: ["rce", "cve", "libheif", "poc", "defense", "heap-use-after-free", "double-free"]
phying_url: "https://phying.com/item/8802"
lang: en
---

# Heap Use-After-Free and Double Free in libheif ImageItem Encoding (GHSA-qwpf-5wf7-r996)

## Summary

A heap use-after-free and double-free flaw affects libheif versions 1.21.0 through 1.23.4 during image encoding. Due to shallow copying of ImageDescription::m_tai_timestamp in ImageItem::encode_to_bitstream_and_boxes, temporary object destruction releases the underlying packet prematurely, leaving dangling pointers. Attackers can trigger this remotely via crafted HEIF files with TAI timestamp properties during transcoding, causing denial-of-service aborts or potential memory corruption. Patched in libheif 1.23.5.

## Why it matters

libheif is a core dependency for HEIF and AVIF image decoding across servers and desktop utilities; services that accept user-uploaded images and transcode them are susceptible to remote crashes and heap exploitation.

## Intelligence Metadata

- **Sources:** github.com
- **CVSS:** 5.9
- **Vendor:** struktur AG
- **Product:** libheif
- **Affected versions:** >= 1.21.0, <= 1.23.4
- **Published:** 2026-09-21T18:27:19Z
- **Original:** https://github.com/strukturag/libheif/security/advisories/GHSA-qwpf-5wf7-r996
- **Phying News:** https://phying.com/item/8802