CVE-2023-49463

What it actually does

Invalid memory access in find_exif_tag causes segmentation violation during EXIF tag parsing in HEIF image files, resulting in process crash and potential memory corruption.

Why it matters to the business

Applications relying on libheif for image decoding may crash when processing untrusted files, leading to service disruption and possible loss of availability in image-heavy workflows; the issue remains unfixed in listed versions despite public exploit availability for over two years.

How an attack unfolds

An attacker crafts a specially malformed HEIF image containing anomalous EXIF data that triggers the vulnerable code path in find_exif_tag, then delivers the file to a target application that uses libheif for decoding, causing the segmentation violation upon parsing.

How to fix it

Upgrade to a version of libheif newer than 1.17.5 that resolves the EXIF parsing flaw; if no fixed version is available, isolate or replace libheif usage with an alternative library until a patch is released.

How to confirm the fix worked

Test image processing with known-malformed HEIF samples containing invalid EXIF data before and after upgrade; monitor application stability and review source or changelog for fixes to find_exif_tag or exif.cc.

Typical attack path

1. Craft malicious HEIF file with crafted EXIF tags
2. Host or embed the file in a location reachable by the victim
3. Victim application opens or processes the image using libheif
4. find_exif_tag executes and dereferences invalid memory
5. Process crashes or exhibits memory corruption

How to detect it

Review application crash logs for segmentation faults originating from exif.cc or find_exif_tag when processing HEIF images; inspect file-handling audit logs for recent access to suspicious HEIF files.

What your security team should do

• Prioritize upgrade of libheif in all affected products as soon as a fixed release is published
• Implement input sanitization or sandboxing for image decoding pipelines handling untrusted files
• Track upstream commits and releases for libheif to confirm resolution of the segmentation violation