CVE-2026-47251 Details

A vulnerability exists in libheif versions through 1.21.2, specifically in the VVC decoder plugin. The issue arises from an integer overflow in a security check added to address a previous vulnerability (CVE-2026-3949). This overflow allows a crafted HEIF file with a VVC track to bypass the security check and trigger an out-of-bounds heap read, similar to the issue CVE-2026-3949 was meant to prevent. The vulnerability can be exploited by decoding a malicious HEIF file using libheif with VVC support enabled, which can lead to a process crash and potentially disclose information from adjacent memory allocations before the crash occurs.

Users can upgrade to libheif version 1.22.0, which patches the vulnerability by properly validating the length of data before processing it, ensuring that the integer overflow cannot be exploited.