Malicious HEIC Images Can Trigger Remote Code Execution on WordPress Servers
Fortbridge showed authenticated WordPress HEIC uploads can exploit libheif and execute code in PHP-FPM.
Fortbridge demonstrated a laboratory chain in which a logged-in WordPress user with the upload_files permission uploads a crafted HEIC file that ImageMagick passes to libheif. Bug GHSA-x8r2-mggj-j6wr lets mismatched color-channel widths overflow memory and redirect a virtual call during decoder cleanup, leading to code execution in PHP-FPM. Pixels in WordPress-generated JPEGs leaked enough memory information to identify the library build and bypass randomization. The flaw affects libheif 1.18.0 through 1.23.2 and is fixed in 1.23.3; researchers reported no active exploitation campaign.
64