Do Son Details and PoC exploit code are out for critical libheif vulnerabilities GHSA-x8r2-mggj-j6wr and GHSA-2jg2-4ch7-h545. Upgrade to 1.23.3 now.
libheif
A WordPress libheif RCE chain and its PoC are now public. The libheif vulnerability turns an HEIC upload into code execution. Patch to 1.23.3.
libheif flaw CVE-2025-65586 causes app crashes via malformed HEIF images. Update to v1.21.0 now to prevent Denial of Service attacks.