CVE-2026-47254

Analyzed Analyzed - Analysis Complete

Heap-Buffer-Overflow in libheif Image Decoder

Publication date: 2026-07-21

Last updated on: 2026-07-27

Assigner: GitHub, Inc.

Description

libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, `Track::init_sample_timing_table()` in `libheif/sequences/track.cc` stores an out-of-bounds chunk index (`m_chunks.size()`) into `m_presentation_timeline` when the number of chunks defined in the `stco` box is less than the number of samples in `stsz`. A subsequent call to `heif_track_get_next_raw_sequence_sample()` reads `m_chunks[chunk_idx]` with that OOB index, causing a heap-buffer-overflow. Version 1.22.0 fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-27

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-09

NVD

CVE-2026-47254

Affected Vendors & Products

Vendor	Product	Version / Range
struktur	libheif	to 1.22.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability is a heap-buffer-overflow issue in libheif, a library for decoding and encoding HEIF and AVIF files. It occurs when the number of chunks in a stco box is less than the number of samples in stsz. This causes an out-of-bounds chunk index to be stored, which is later used to read memory, leading to a heap buffer overflow.

Detection Guidance

Detecting this vulnerability requires checking the version of libheif installed on your system. If you are using a version prior to 1.22.0, your system may be vulnerable. Run the command 'libheif-decoder --version' or 'apt show libheif1' (for Debian-based systems) to check the installed version.

Impact Analysis

This vulnerability could allow an attacker to execute arbitrary code or cause a denial of service by triggering a heap buffer overflow when processing maliciously crafted HEIF or AVIF files. It may lead to crashes or unauthorized memory access on systems using vulnerable versions of libheif.

Compliance Impact

This vulnerability involves a heap-buffer-overflow in libheif, which could lead to memory corruption or crashes. While not directly tied to data privacy, such flaws may impact compliance by exposing systems to denial-of-service or potential unauthorized access if exploited. However, no specific compliance impact is detailed in the provided context.

Mitigation Strategies

Immediately update libheif to version 1.22.0 or later. For Debian-based systems, run 'sudo apt update && sudo apt upgrade libheif1'. For other systems, download the latest version from the official libheif repository or package manager.

Hi! I’m here to help you understand CVE-2026-47254. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70