CVE-2026-47178

Analyzed Analyzed - Analysis Complete

Heap Out-of-Bounds Write in libheif

Publication date: 2026-07-21

Last updated on: 2026-07-27

Assigner: GitHub, Inc.

Description

libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.19.0 through 1.21.2, a crafted HEIF file (uncompressed `unci` codec, tiled, component-interleaved, 4:2:0) triggers a heap out-of-bounds write in libheif's uncompressed tile decoder. The write overwrites the C++ vtable pointer of an adjacent `unc_decoder_component_interleave` object; the next virtual call dispatches to an attacker-chosen address. Version 1.22.0 patches the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-27

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-09

NVD

CVE-2026-47178

Affected Vendors & Products

Vendor	Product	Version / Range
struktur	libheif	From 1.19.0 (inc) to 1.22.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

libheif versions 1.19.0 to 1.21.2 contain a flaw in the uncompressed tile decoder where a specially crafted HEIF file can trigger a heap out-of-bounds write. This write corrupts the C++ vtable pointer of an adjacent object, leading to arbitrary code execution when a virtual function is called.

Detection Guidance

Detection requires analyzing files processed by libheif versions 1.19.0 to 1.21.2. Check installed versions with 'libheif --version'. Scan files using tools like 'heif-info' or 'avif-info' for malformed HEIF/AVIF files. Monitor for crashes or memory corruption when processing such files.

Impact Analysis

An attacker could exploit this to execute arbitrary code on your system by tricking you into opening a malicious HEIF or AVIF file. This could lead to data theft, system compromise, or further attacks depending on your environment.

Compliance Impact

This vulnerability could potentially lead to unauthorized code execution, which may result in data breaches or unauthorized access to sensitive information. For GDPR, this could impact data confidentiality and integrity requirements. For HIPAA, it might compromise protected health information if exploited.

Mitigation Strategies

Update libheif to version 1.22.0 or later to patch the heap out-of-bounds write vulnerability in the uncompressed tile decoder.

Hi! I’m here to help you understand CVE-2026-47178. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70