No file is 100% safe
An image looks inert, but opening it means a program parses a complicated binary format. Parsers are software, and software has bugs. One real example: CVE-2023-41064 is an entry in the CVE Program’s public record, and we cite it as a real example of a vulnerability record for image-handling software. Open the record to see the vendor, affected versions and description. We use it as an example that such issues exist, and we make no claim about whether your device is affected today.
The practical lesson is not to avoid images. It is to keep software updated, and to be thoughtful about where untrusted files get opened.
Where the risk sits
Most risk is in decoders and parsers: code that reads headers, tables and compressed data, often written in C or C++ for speed. HEIC adds layers: a container (HEIF) with many structures, plus a video-derived codec. The open-source libheif project has a SECURITY.md describing how security issues are reported, which shows the maintainers treat this as a normal part of the work. libde265 is the H.265 decoder it uses by default for HEIC.
A broken or hostile file can crash a program or, in the worst case, exploit a bug. A merely damaged file can do neither, but will not open.
Habits that help
- Update your operating system and apps. Parser fixes arrive through updates.
- Be wary of unknown senders. Opening a photo from a stranger is a lower risk than running a program, but not zero.
- Do not trust extensions. A file named
holiday.jpgcan be anything. FromHEIC’s file checker reads the type from the contents and reports size, dimensions, number of images, codec and basic integrity. - Prefer a sandboxed environment. A browser tab runs in the browser’s sandbox, separate from the rest of your system.
- Keep the original. If something goes wrong, you still have the source.
What FromHEIC does to limit exposure
- All processing runs in your browser inside a Web Worker. Files are not uploaded.
- The Content-Security-Policy limits network connections to the site’s own origin and Google Analytics, which loads only if you accept it, which greatly narrows where a bug in a codec could send your file.
- Codecs are WebAssembly modules (libheif with libde265 for decoding) served from the same domain.
- Type detection is from content, and each output is re-parsed or decoded before download is offered.
- Limits exist: 200 MB per file, 100 megapixels per image, 200 files per batch.
This reduces risk; it does not remove it. A WebAssembly decoder can still have bugs, and the browser can too. The aim is that a failure stays inside the tab. The Security page of this site says the same in more detail.
Inspect before you convert
Three tools look at a file without trying to repair or alter it:
- The health check detects truncation, wrong extension, an invalid container, unsupported codecs and malformed EXIF, then attempts a real decode.
- The HEIC inspector shows the structure: brands, codec, items, thumbnails and so on.
- The file checker gives the true type and basic integrity.
If a file is odd, a failed check is information.
Metadata is a privacy risk too
Safety is not only about code execution. Photos carry personal data. ExifTool lists the GPS tags a file may hold, such as latitude and longitude. Before sharing, check with the metadata guide and consider Remove HEIC metadata. Apple also notes that some sharing methods may convert media to a more compatible format, which is not a privacy feature and should not be relied on to strip anything.
When to be more careful
- A file from an unknown source that you must open.
- A file that crashes software repeatedly.
- A “photo” with an unexpected extension or size.
In those cases, use a current browser, open it there rather than in an older desktop program, and do not open it on a device holding sensitive data if you can avoid it. If in doubt, ask the sender for another copy.
Reporting problems
If you think you found a problem in FromHEIC, see the Contact page. For the underlying libraries, follow each project’s own reporting process.