Heap Out-of-Bounds Write in libheif

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: GitHub, Inc.

Description

libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.19.0 through 1.21.2, a crafted HEIF file (uncompressed `unci` codec, tiled, component-interleaved, 4:2:0) triggers a heap out-of-bounds write in libheif's uncompressed tile decoder. The write overwrites the C++ vtable pointer of an adjacent `unc_decoder_component_interleave` object; the next virtual call dispatches to an attacker-chosen address. Version 1.22.0 patches the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-21

Generated

2026-07-22

AI Q&A

2026-07-22

EPSS Evaluated

N/A

NVD

CVE-2026-47178

Affected Vendors & Products

Vendor	Product	Version / Range
structural_heif	libheif	From 1.19.0 (inc) to 1.21.2 (inc)
structural_heif	libheif	1.22.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

libheif versions 1.19.0 to 1.21.2 contain a flaw in the uncompressed tile decoder where a specially crafted HEIF file can trigger a heap out-of-bounds write. This write corrupts the C++ vtable pointer of an adjacent object, leading to arbitrary code execution when a virtual function is called.

Impact Analysis

An attacker could exploit this to execute arbitrary code on your system by tricking you into opening a malicious HEIF or AVIF file. This could lead to data theft, system compromise, or further attacks depending on your environment.

Mitigation Strategies

Update libheif to version 1.22.0 or later to patch the heap out-of-bounds write vulnerability in the uncompressed tile decoder.

Hi! I’m here to help you understand CVE-2026-47178. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70