Microsoft Heif Image Extension vulnerabilities

4 CVEs affecting Microsoft Heif Image Extension, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-81353, published 2026-09-08.

More from Microsoft.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2022-24457, published 2022-03-09. High severity, CVSS 7.8. EPSS: 2.3% chance of exploitation in the next 30 days. HEIF Image Extensions Remote Code Execution Vulnerability
• CVE-2025-62821, published 2026-06-19. Critical severity, CVSS 9.1. EPSS: 1.1% chance of exploitation in the next 30 days. Microsoft HEIF Image Extensions 1.2.22.0 has an out-of-bounds read because CHEIFItemInfoEntry_GetDataSize can return success while leaving the reported data size as 0. This causes a caller to make a…
• CVE-2020-17101, published 2020-11-11. High severity, CVSS 7.8. EPSS: 0.9% chance of exploitation in the next 30 days. HEIF Image Extensions Remote Code Execution Vulnerability
• CVE-2026-81353, published 2026-09-08. High severity, CVSS 7.8. EPSS: 0.5% chance of exploitation in the next 30 days. Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code locally.