HEIC and HEIF are modern image formats used by phones and camera apps to store photos efficiently, often with high quality and smaller file sizes than older formats. Because they are not displayed directly, software must first decode them before a picture can be previewed, resized, or converted. That decoding step is security-sensitive: the parser must interpret structured, user-controlled data correctly.
In cyber security, HEIC / HEIF matters because attackers can weaponize malformed files to target image libraries and server-side media pipelines. If a decoder has a memory-safety bug, a crafted upload may cause a crash, corrupt memory, or in some cases help an attacker gain code execution. Defenders reduce this risk by keeping image libraries patched, limiting server-side processing of untrusted uploads, and reviewing whether applications actually need to accept these formats.