A critical heap buffer overflow in libheif (CVSS v4 9.5) exploited via crafted AVIF images leads to remote code execution in Next.js when AVIF optimization is enabled. Patches disable AVIF optimization until upstream fix is available.
A critical heap buffer overflow in libheif (CVSS v4 9.5) exploited via crafted AVIF images leads to remote code execution in Next.js when AVIF optimization is enabled. Patches disable AVIF optimization until upstream fix is available.