CVE-2026-48029
Received Received - Intake

Heap OOB Read in libheif ImageItem_Grid

Publication date: 2026-07-22

Last updated on: 2026-07-22

Assigner: GitHub, Inc.

Description
libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.19.0 through 1.21.2 have a heap OOB read in ImageItem_Grid::decode_grid_tile via irot-induced tile-coordinate underflow. Version 1.22.0 fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-22
Last Modified
2026-07-22
Generated
2026-07-22
AI Q&A
2026-07-22
EPSS Evaluated
N/A
NVD
CVE-2026-48029
EUVD
EUVD-2026-47710

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
strukturag libheif From 1.19.0 (inc) to 1.21.2 (inc)
strukturag libheif 1.22.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-191 The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a heap out-of-bounds read in the libheif library affecting versions 1.19.0 through 1.21.2. It occurs when processing HEIF/HEIC files with rotated images (90, 180, or 270 degrees) and a grid item where rows do not equal columns. The issue stems from improper validation of tile coordinates during rotation, leading to integer underflow and out-of-bounds memory access.

Detection Guidance

This vulnerability is specific to libheif versions 1.19.0 through 1.21.2 and involves malformed HEIF/AVIF files with irot rotation properties. Detection requires checking libheif versions and analyzing files for the described conditions. No direct network detection commands exist; focus on version checks and file inspection.

Impact Analysis

This vulnerability can cause crashes (denial of service) via segmentation faults, especially in release builds. Attackers could exploit it by tricking users into opening malicious HEIF/HEIC files, potentially leading to system instability or unauthorized memory access. The impact is higher if the library is used in applications processing untrusted files.

Compliance Impact

This vulnerability primarily impacts system availability due to potential denial of service via segmentation faults. It does not directly expose or leak sensitive data, which is a key concern for GDPR and HIPAA compliance. However, repeated crashes could disrupt services handling personal or health data, potentially violating availability requirements under these regulations.

Mitigation Strategies
  • Upgrade libheif to version 1.22.0 or later to address the vulnerability.
  • Avoid processing HEIF/HEIC files with irot rotation properties set to 90, 180, or 270 degrees until upgraded.
  • Implement runtime bounds checks for tile coordinates in applications using libheif.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-48029. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart