CVE-2026-47178
published 2026-07-21CVE-2026-47178: libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.19.0 through 1.21.2, a crafted HEIF file (uncompressed `unci` codec, tiled…
PriorityP342high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
EPSS
0.18%
7.4th percentile
libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.19.0 through 1.21.2, a crafted HEIF file (uncompressed `unci` codec, tiled, component-interleaved, 4:2:0) triggers a heap out-of-bounds write in libheif's uncompressed tile decoder. The write overwrites the C++ vtable pointer of an adjacent `unc_decoder_component_interleave` object; the next virtual call dispatches to an attacker-chosen address. Version 1.22.0 patches the issue.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| struktur | libheif | >= 1.19.0 < 1.22.0 | 1.22.0 |
| strukturag | libheif | — | — |
| ubuntu | libheif | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
vendor_ubuntu6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
strukturag libheif up to 1.21.1 Decoder heap-based overflow (Nessus ID 333527)
vuldb·2026-08-09·CVSS 7.8
CVE-2026-47178 [HIGH] strukturag libheif up to 1.21.1 Decoder heap-based overflow (Nessus ID 333527)
A vulnerability was found in strukturag libheif up to 1.21.1. It has been rated as critical. Impacted is an unknown function of the component Decoder. This manipulation causes heap-based buffer overflow.
The identification of this vulnerability is CVE-2026-47178. It is possible to initiate the attack remotely. There is no exploit available.
Upgrading the affected component is advised.
Ubuntu
libheif vulnerabilities
vendor_ubuntu·2026-06-29·CVSS 6.5
CVE-2026-47178 [MEDIUM] libheif vulnerabilities
Title: libheif vulnerabilities
Summary: Several security issues were fixed in libheif.
It was discovered that libheif incorrectly handled certain crafted HEIF
files. An attacker could possibly use this issue to cause a denial of
service or execute arbitrary code. (CVE-2026-47178)
It was discovered that libheif incorrectly validated offsets when
decoding certain crafted HEIF files. An attacker could possibly use this
issue to cause a denial of service. This issue only affected Ubuntu 26.04
LTS. (CVE-2026-49271)
Instructions: In general, a standard system update will make all the necessary changes.
No detection rules found.
No public exploits indexed.
Bugzilla
libheif F43/F44 remain on vulnerable upstream versions despite existing Red Hat Product Security trackers
bugzilla·2026-09-18·CVSS 8.8
CVE-2026-32740 [HIGH] libheif F43/F44 remain on vulnerable upstream versions despite existing Red Hat Product Security trackers
libheif F43/F44 remain on vulnerable upstream versions despite existing Red Hat Product Security trackers
The Fedora 43 and Fedora 44 `libheif` packages appear to be behind multiple upstream security fixes that are already being tracked by Red Hat Product Security.
Current Fedora packages:
* Fedora 43: `libheif-1.20.2-6.fc43`
* Fedora 44: `libheif-1.21.2-1.fc44`
Multiple Red Hat Product Security trackers explicitly identify versions including Fedora's current 1.20.x/1.21.2 packages as affected.
Examples include:
* CVE-2026-32740 — Red Hat Bug 2479969
Affects `libheif` 1.21.2 and earlier; upstream fix in 1.22.0.
* CVE-2026-32741 — Red Hat Bug 2480002
Affects versions through 1.21.2; upstream fix in 1.22.0.
* CVE-2026-32814 — Red Hat Bug 2480001
Affects versions through 1.21.2; upstr
Bugzilla
CVE-2026-47178 libheif: libheif: Arbitrary code execution via crafted HEIF file [epel-all]
bugzilla·2026-07-23·CVSS 6.1
CVE-2026-47178 [MEDIUM] CVE-2026-47178 libheif: libheif: Arbitrary code execution via crafted HEIF file [epel-all]
CVE-2026-47178 libheif: libheif: Arbitrary code execution via crafted HEIF file [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.19.0 through 1.21.2, a crafted HEIF file (uncompressed `unci` codec, tiled, component-interleaved, 4:2:0) triggers a heap out-of-bounds write in libheif's uncompressed tile decoder. The write overwrites the C++ vtable pointer of an adjacent `unc_decoder_component_interleave` object; the next virtual call dispatches to an attacker-chosen address. Version 1.22.0 patches the issue.
Bugzilla
CVE-2026-47178 libheif: libheif: Arbitrary code execution via crafted HEIF file [fedora-all]
bugzilla·2026-07-23·CVSS 6.1
CVE-2026-47178 [MEDIUM] CVE-2026-47178 libheif: libheif: Arbitrary code execution via crafted HEIF file [fedora-all]
CVE-2026-47178 libheif: libheif: Arbitrary code execution via crafted HEIF file [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.19.0 through 1.21.2, a crafted HEIF file (uncompressed `unci` codec, tiled, component-interleaved, 4:2:0) triggers a heap out-of-bounds write in libheif's uncompressed tile decoder. The write overwrites the C++ vtable pointer of an adjacent `unc_decoder_component_interleave` object; the next virtual call dispatches to an attacker-chosen address. Version 1.22.0 patches the issue.
Bugzilla
CVE-2026-47178 libheif: libheif: Arbitrary code execution via crafted HEIF file
bugzilla·2026-07-21·CVSS 6.1
CVE-2026-47178 [MEDIUM] CVE-2026-47178 libheif: libheif: Arbitrary code execution via crafted HEIF file
CVE-2026-47178 libheif: libheif: Arbitrary code execution via crafted HEIF file
libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.19.0 through 1.21.2, a crafted HEIF file (uncompressed `unci` codec, tiled, component-interleaved, 4:2:0) triggers a heap out-of-bounds write in libheif's uncompressed tile decoder. The write overwrites the C++ vtable pointer of an adjacent `unc_decoder_component_interleave` object; the next virtual call dispatches to an attacker-chosen address. Version 1.22.0 patches the issue.
2026-07-21
Published