CVE-2024-48514

Remote code execution in php-heic-to-jpg

9.8 CriticalFix available

php-heic-to-jpg <= 1.0.5 is vulnerable to code injection (fixed in 1.0.6). An attacker who can upload heic images is able to execute code on the remote server via the file name. As a result, the CIA is no longer guaranteed. This affects php-heic-to-jpg 1.0.5 and below.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.99%Up 0.9 points since Oct 25, 2024

What each source reports

CVE List Score used 9.8

Record: CVE-2024-48514
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-94
Updated: 2026-11-02

EUVDEUVD-2024-3045 9.8

Record: EUVD-2024-3045
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-03

GitHub AdvisoriesGHSA-g8v9-c8m3-942v 8.1

Remote code execution in php-heic-to-jpg

php-heic-to-jpg < 1.0.5 is vulnerable to remote code execution. An attacker who can upload heic images is able to execute code on the remote server via the file name. As a result, the CIA is no longer guaranteed. This affects php-heic-to-jpg below 1.0.5.

Record: GHSA-g8v9-c8m3-942v
CVSS 4.0: 8.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-94
Updated: 2026-11-02

NVD 9.8

Record: CVE-2024-48514
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-94
Updated: 2026-11-02

OSV 9.8

Record: CVE-2024-48514
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVGHSA-g8v9-c8m3-942v 8.1

Remote code execution in php-heic-to-jpg

Record: GHSA-g8v9-c8m3-942v
CVSS 4.0: 8.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-94
Updated: 2026-11-02

Affected products

maestroerror php-heic-to-jpg

Affected packages

Affected packages
Package	Affected	Fixed
`maestroerror/php-heic-to-jpg` Packagist	before 1.0.5	1.0.5
`maestroerror/php-heic-to-jpg` Packagist	before 1.0.5, plus listed versions v0.1v0.2v0.3v0.3.1v0.3.2 Show 6 moreShow less v0.4.0v1.0v1.0.1v1.0.2v1.0.3v1.0.4	1.0.5

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-48514 is a critical vulnerability (CVSS 9.8) in Maestroerror Php-heic-to-jpg, published October 24, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.99%, the 62nd percentile. Fixed in maestroerror/php-heic-to-jpg 1.0.5.