CVE-2025-43967

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-04-21 · updated 2026-06-17
Weakness: CWE-476

Description

libheif before 1.19.6 has a NULL pointer dereference in ImageItem_Grid::get_decoder in image-items/grid.cc because a grid image can reference a nonexistent image item.

Affected products

strukturag libheif: before 1.19.6 — fixed in 1.19.6

How to fix

Upgrade to a fixed version: strukturag libheif 1.19.6. Check the vendor advisory for mitigations.

References

https://github.com/strukturag/libheif/commit/6e35af7b0ff9fb6cc952a1539590d160db32f671
https://github.com/strukturag/libheif/compare/v1.19.5...v1.19.6
https://github.com/strukturag/libheif/issues/1455

Get alerted when CVE-2025-43967 or the next vulnerability affects your stack