CVE-2026-47247

Received Received - Intake

Heap Memory Leak in libheif Image Decoding

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: GitHub, Inc.

Description

libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, two bugs in libheif chain to leak process heap memory as visible pixel values in decoded grid images. An attacker who uploads a crafted AVIF/HEIC file to any server-side image processor (WordPress, Sharp/libvips, ImageMagick, etc.) can recover heap data - including library function pointers sufficient to defeat ASLR, or any other secret - from the publicly-downloadable transcoded JPEG/PNG/WebP output. Local attack vectors are also possible. Version 1.22.0 fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-21

Generated

2026-07-22

AI Q&A

2026-07-22

EPSS Evaluated

N/A

NVD

CVE-2026-47247

Affected Vendors & Products

Vendor	Product	Version / Range
structural_heif	libheif	to 1.22.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-226	The product releases a resource such as memory or a file so that it can be made available for reuse, but it does not clear or "zeroize" the information contained in the resource before the product performs a critical state transition or makes the resource available for reuse by other entities.
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-908	The product uses or accesses a resource that has not been initialized.
CWE-682	The product performs a calculation that generates incorrect or unintended results that are later used in security-critical decisions or resource management.

Attack-Flow Graph

Executive Summary

This vulnerability in libheif versions before 1.22.0 allows memory leaks in grid images. Attackers can craft malicious AVIF/HEIC files that cause the library to expose heap memory in output images like JPEG or PNG. This leaked data may include sensitive information such as function pointers that could bypass security measures like ASLR.

Detection Guidance

Detection involves checking for libheif versions prior to 1.22.0 and analyzing image processing outputs for unusual pixel values that may indicate heap memory leaks. Inspect server-side image processors like WordPress, ImageMagick, or Sharp/libvips for any AVIF/HEIC file processing. No specific commands are provided in the context.

Impact Analysis

If you process images using affected software (e.g., WordPress, ImageMagick), an attacker could upload a malicious file to recover sensitive data from your server's memory. This includes secrets or internal pointers that might compromise system security. Local attacks are also possible if users process untrusted files.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating confidentiality requirements in GDPR and HIPAA. If sensitive data is leaked through processed images, organizations may face compliance violations, legal penalties, and reputational damage due to breaches of data protection standards.

Mitigation Strategies

Upgrade libheif to version 1.22.0 or later immediately. Disable or restrict processing of AVIF/HEIC files on servers if possible. Monitor network traffic for suspicious image uploads and review processed image outputs for anomalies.

Hi! I’m here to help you understand CVE-2026-47247. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70