CVE-2026-49271 Details
Description
libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.1, the uncompressed HEIF decoder validates explicit icef compressed-unit offsets using unit_offset + unit_size. Because the addition can wrap, a crafted HEIF file can pass the range check and then construct a vector from iterators outside the compressed item buffer, producing an out-of-bounds heap read and crash. Version 1.22.1 patches the issue.
A vulnerability in the uncompressed HEIF decoder of libheif, prior to version 1.22.1, allows for an out-of-bounds heap read and subsequent crash. The issue arises because the decoder validates icef compressed-unit offsets using a calculation that can wrap around, enabling a crafted HEIF file to bypass range checks. This manipulation can lead to reading data from outside the intended buffer, causing a crash during the decoding process.
Users can upgrade to libheif version 1.22.1 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/strukturag/libheif/security/advisories/GHSA-r7qj-cg5r-r6vf | CISA-ADP | MitigationVendor Advisory |
| https://github.com/strukturag/libheif/security/advisories/GHSA-r7qj-cg5r-r6vf | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| struktur libheif | < 1.22.1 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 26, 2026 | Initial Analysis | [email protected] |
| Jun 22, 2026 | CVE Modified | CISA-ADP |
| Jun 19, 2026 | New CVE Received | [email protected] |