CVE-2026-47709

Analyzed Analyzed - Analysis Complete

libheif Null Pointer Dereference in HEIF/AVIF Decoder

Publication date: 2026-07-21

Last updated on: 2026-07-27

Assigner: GitHub, Inc.

Description

libheif is a HEIF and AVIF file format decoder and encoder. Versions prior to 1.22.0 crashes in the public C API `heif_image_handle_get_image_tiling()` when a malformed uncompressed HEIF image item has an associated `uncC` property but no associated `ispe` property. In debug builds this trips the `ispe && uncC` assertion in `ImageItem_uncompressed::get_heif_image_tiling()`. In a release/NDEBUG ASan build, the same file causes a null pointer read at address `0xa8`. Version 1.22.0 fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-27

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-10

NVD

CVE-2026-47709

Affected Vendors & Products

Vendor	Product	Version / Range
struktur	libheif	to 1.22.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-476	The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

Executive Summary

This vulnerability affects libheif, a HEIF and AVIF file format decoder and encoder. Versions before 1.22.0 crash when processing malformed uncompressed HEIF images that have an uncC property but lack an ispe property. In debug builds, it triggers an assertion failure. In release builds with AddressSanitizer, it causes a null pointer read at address 0xa8.

Detection Guidance

This vulnerability can be detected by checking the version of libheif installed on your system. If it is prior to 1.22.0, it is vulnerable. Use commands like 'heif-info --version' or 'dpkg -l | grep libheif' to check the installed version.

Impact Analysis

The vulnerability could allow attackers to crash applications using vulnerable libheif versions by providing specially crafted HEIF or AVIF files. This may lead to denial-of-service conditions or potential code execution if exploited.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a software crash issue in libheif related to malformed HEIF image files, which could lead to denial of service but does not inherently violate data protection or privacy requirements.

Mitigation Strategies

Upgrade libheif to version 1.22.0 or later. This can typically be done using package managers like 'apt upgrade libheif1' on Debian-based systems or 'yum update libheif' on RHEL-based systems.

Hi! I’m here to help you understand CVE-2026-47709. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70