CVE-2026-47254
published 2026-07-21CVE-2026-47254: libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, `Track::init_sample_timing_table()` in `libheif/sequences/track.cc` stores…
PriorityP425medium6.1CVSS 3.1
AVLACLPRNUIRSUCLINAH
EPSS
0.19%
8.8th percentile
libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, `Track::init_sample_timing_table()` in `libheif/sequences/track.cc` stores an out-of-bounds chunk index (`m_chunks.size()`) into `m_presentation_timeline` when the number of chunks defined in the `stco` box is less than the number of samples in `stsz`. A subsequent call to `heif_track_get_next_raw_sequence_sample()` reads `m_chunks[chunk_idx]` with that OOB index, causing a heap-buffer-overflow. Version 1.22.0 fixes the issue.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux_kernel | >= 0 < 4.4.0-279.313 | 4.4.0-279.313 |
| struktur | libheif | < 1.22.0 | 1.22.0 |
| strukturag | libheif | < 1.22.0 | 1.22.0 |
| ubuntu | libheif | — | — |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
osv5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
libheif vulnerabilities
vendor_ubuntu·2026-07-09
CVE-2026-47709 libheif vulnerabilities
Title: libheif vulnerabilities
Summary: Several security issues were fixed in libheif.
Xianrui Dong discovered that libheif had an out-of-bounds read in its
HEIF sequence track parser. An attacker could possibly use this issue
to cause a denial of service or obtain sensitive information. This issue
only affected Ubuntu 26.04 LTS. (CVE-2026-47254)
Junyi Liu discovered that libheif had a null pointer dereference in its
image tiling interface. An attacker could possibly use this issue to
cause a denial of service. (CVE-2026-47709)
Calvin Young and Enoch Chow discovered that libheif had an integer
overflow in its inline mask size calculation. An attacker could
possibly use this issue to cause a denial of service or obtain sensitive
information. (CVE-2026-47714)
Ariel Koren discovered that
OSV
linux-fips vulnerabilities
osv·2026-04-02·CVSS 5.5
CVE-2021-47142 linux-fips vulnerabilities
linux-fips vulnerabilities
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Cryptographic API;
- GPU drivers;
- BTRFS file system;
- GFS2 file system;
- UDF file system;
- NFC subsystem;
- Network traffic control;
(CVE-2021-47142, CVE-2021-47145, CVE-2021-47254, CVE-2024-46777,
CVE-2025-21735, CVE-2026-23060, CVE-2026-23074)
OSV
linux, linux-aws, linux-kvm, linux-lts-xenial vulnerabilities
osv·2026-04-01·CVSS 5.5
CVE-2021-47142 linux, linux-aws, linux-kvm, linux-lts-xenial vulnerabilities
linux, linux-aws, linux-kvm, linux-lts-xenial vulnerabilities
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Cryptographic API;
- GPU drivers;
- BTRFS file system;
- GFS2 file system;
- UDF file system;
- NFC subsystem;
- Network traffic control;
(CVE-2021-47142, CVE-2021-47145, CVE-2021-47254, CVE-2024-46777,
CVE-2025-21735, CVE-2026-23060, CVE-2026-23074)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-47254 libheif: libheif: Heap-buffer-overflow due to out-of-bounds write in sample timing table [fedora-all]
bugzilla·2026-07-23·CVSS 6.1
CVE-2026-47254 [MEDIUM] CVE-2026-47254 libheif: libheif: Heap-buffer-overflow due to out-of-bounds write in sample timing table [fedora-all]
CVE-2026-47254 libheif: libheif: Heap-buffer-overflow due to out-of-bounds write in sample timing table [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, `Track::init_sample_timing_table()` in `libheif/sequences/track.cc` stores an out-of-bounds chunk index (`m_chunks.size()`) into `m_presentation_timeline` when the number of chunks defined in the `stco` box is less than the number of samples in `stsz`. A subsequent call to `heif_track_get_next_raw_sequence_sample()` reads `m_chunks[chunk_idx]` with that OOB index, causi
Bugzilla
CVE-2026-47254 libheif: libheif: Heap-buffer-overflow due to out-of-bounds write in sample timing table [epel-all]
bugzilla·2026-07-23·CVSS 6.1
CVE-2026-47254 [MEDIUM] CVE-2026-47254 libheif: libheif: Heap-buffer-overflow due to out-of-bounds write in sample timing table [epel-all]
CVE-2026-47254 libheif: libheif: Heap-buffer-overflow due to out-of-bounds write in sample timing table [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, `Track::init_sample_timing_table()` in `libheif/sequences/track.cc` stores an out-of-bounds chunk index (`m_chunks.size()`) into `m_presentation_timeline` when the number of chunks defined in the `stco` box is less than the number of samples in `stsz`. A subsequent call to `heif_track_get_next_raw_sequence_sample()` reads `m_chunks[chunk_idx]` with that OOB index, causing
Bugzilla
CVE-2026-47254 libheif: libheif: Heap-buffer-overflow due to out-of-bounds write in sample timing table
bugzilla·2026-07-21·CVSS 6.1
CVE-2026-47254 [MEDIUM] CVE-2026-47254 libheif: libheif: Heap-buffer-overflow due to out-of-bounds write in sample timing table
CVE-2026-47254 libheif: libheif: Heap-buffer-overflow due to out-of-bounds write in sample timing table
libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, `Track::init_sample_timing_table()` in `libheif/sequences/track.cc` stores an out-of-bounds chunk index (`m_chunks.size()`) into `m_presentation_timeline` when the number of chunks defined in the `stco` box is less than the number of samples in `stsz`. A subsequent call to `heif_track_get_next_raw_sequence_sample()` reads `m_chunks[chunk_idx]` with that OOB index, causing a heap-buffer-overflow. Version 1.22.0 fixes the issue.
2026-07-21
Published