CVE-2026-47251

Analyzed Analyzed - Analysis Complete

Integer Overflow in libheif HEIF/AVIF Decoder

Publication date: 2026-07-21

Last updated on: 2026-07-27

Assigner: GitHub, Inc.

Description

libheif is a HEIF and AVIF file format decoder and encoder. The fix for CVE-2026-3949 (commit `b97c8b5`, PR #1712) introduced an integer overflow in the very security check it added. The check itself can be bypassed, allowing a crafted HEIF file with a VVC track to trigger the same out-of-bounds heap read that CVE-2026-3949 was meant to prevent. This is a separate, currently-unpatched vulnerability. Issue #1712 was closed as fixed without testing the edge case where `size` is near `UINT32_MAX`. Version 1.22.0 patches the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-27

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-09

NVD

CVE-2026-47251

Affected Vendors & Products

Vendor	Product	Version / Range
struktur	libheif	to 1.22.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-190	The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability is an integer overflow in libheif, a HEIF and AVIF file format decoder and encoder. It bypasses a security check added to fix CVE-2026-3949, allowing crafted HEIF files with VVC tracks to trigger out-of-bounds heap reads. The issue was not fully tested for edge cases where size nears UINT32_MAX and remains unpatched in versions before 1.22.0.

Detection Guidance

Detection requires checking for vulnerable libheif versions. Use commands like 'apt list --installed | grep libheif' or 'rpm -qa | grep libheif' to identify installed versions. Compare against version 1.22.0 or later.

Impact Analysis

This vulnerability could allow attackers to execute arbitrary code or cause denial-of-service attacks by exploiting out-of-bounds heap reads in libheif. Users processing malicious HEIF or AVIF files may experience crashes or system compromise.

Compliance Impact

This vulnerability involves an integer overflow in libheif that allows bypassing security checks, potentially leading to out-of-bounds heap reads. While not directly tied to compliance standards, such vulnerabilities could impact data integrity and confidentiality, which are key concerns for GDPR and HIPAA. However, specific compliance impacts depend on system implementation and use case.

Mitigation Strategies

Update libheif to version 1.22.0 or later to patch the integer overflow vulnerability in HEIF/AVIF file handling.

Hi! I’m here to help you understand CVE-2026-47251. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70