CVE-2026-47178 Details
Description
libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.19.0 through 1.21.2, a crafted HEIF file (uncompressed `unci` codec, tiled, component-interleaved, 4:2:0) triggers a heap out-of-bounds write in libheif's uncompressed tile decoder. The write overwrites the C++ vtable pointer of an adjacent `unc_decoder_component_interleave` object; the next virtual call dispatches to an attacker-chosen address. Version 1.22.0 patches the issue.
A heap out-of-bounds write vulnerability has been identified in libheif versions 1.19.0 prior to 1.21.2. This issue arises in the uncompressed tile decoder when handling crafted HEIF files that use the uncompressed 'unci' codec, are tiled, component-interleaved, and formatted in 4:2:0 chroma subsampling. The vulnerability allows an attacker to overwrite the C++ vtable pointer of an adjacent 'unc_decoder_component_interleave' object. This manipulation can redirect the execution flow to an address chosen by the attacker, potentially leading to arbitrary code execution. The vulnerability can be exploited in any process that decodes a crafted HEIF file with 'WITH_UNCOMPRESSED_CODEC=ON', including image processing applications and server-side thumbnail or transcode services.
Users should upgrade to libheif version 1.22.0 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/strukturag/libheif/security/advisories/GHSA-5x55-x5pf-9c6g | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-787 | Out-of-bounds Write | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| struktur libheif | >= 1.19.0, < 1.22.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 27, 2026 | Initial Analysis | [email protected] |
| Jul 22, 2026 | CVE Modified | CISA-ADP |
| Jul 21, 2026 | New CVE Received | [email protected] |