CVE-2026-47709
published 2026-07-21CVE-2026-47709: libheif is a HEIF and AVIF file format decoder and encoder. Versions prior to 1.22.0 crashes in the public C API `heif_image_handle_get_image_tiling()` when a…
PriorityP423medium5.5CVSS 3.1
AVLACLPRNUIRSUCNINAH
EPSS
0.21%
11.8th percentile
libheif is a HEIF and AVIF file format decoder and encoder. Versions prior to 1.22.0 crashes in the public C API `heif_image_handle_get_image_tiling()` when a malformed uncompressed HEIF image item has an associated `uncC` property but no associated `ispe` property. In debug builds this trips the `ispe && uncC` assertion in `ImageItem_uncompressed::get_heif_image_tiling()`. In a release/NDEBUG ASan build, the same file causes a null pointer read at address `0xa8`. Version 1.22.0 fixes the issue.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| struktur | libheif | < 1.22.0 | 1.22.0 |
| strukturag | libheif | < 1.22.0 | 1.22.0 |
| ubuntu | libheif | — | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
nvdv4.06.9MEDIUMCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
libheif vulnerabilities
vendor_ubuntu·2026-07-14
CVE-2026-47714 libheif vulnerabilities
Title: libheif vulnerabilities
Summary: Several security issues were fixed in libheif.
USN-8526-1 fixed vulnerabilities in libheif. This update provides the
corresponding updates for CVE-2026-47709 and CVE-2026-47714 in
Ubuntu 24.04 LTS.
Original advisory details:
Junyi Liu discovered that libheif had a null pointer dereference in its
image tiling interface. An attacker could possibly use this issue to
cause a denial of service. (CVE-2026-47709)
Calvin Young and Enoch Chow discovered that libheif had an integer
overflow in its inline mask size calculation. An attacker could
possibly use this issue to cause a denial of service or obtain sensitive
information. (CVE-2026-47714)
Instructions: In general, a standard system update will make all the necessary
changes.
Ubuntu
libheif vulnerabilities
vendor_ubuntu·2026-07-09
CVE-2026-47709 libheif vulnerabilities
Title: libheif vulnerabilities
Summary: Several security issues were fixed in libheif.
Xianrui Dong discovered that libheif had an out-of-bounds read in its
HEIF sequence track parser. An attacker could possibly use this issue
to cause a denial of service or obtain sensitive information. This issue
only affected Ubuntu 26.04 LTS. (CVE-2026-47254)
Junyi Liu discovered that libheif had a null pointer dereference in its
image tiling interface. An attacker could possibly use this issue to
cause a denial of service. (CVE-2026-47709)
Calvin Young and Enoch Chow discovered that libheif had an integer
overflow in its inline mask size calculation. An attacker could
possibly use this issue to cause a denial of service or obtain sensitive
information. (CVE-2026-47714)
Ariel Koren discovered that
VulDB
strukturag libheif up to 1.21.x Public C API heif_image_handle_get_image_tiling null pointer dereference (Nessus ID 333527)
vuldb·2026-08-09·CVSS 5.5
CVE-2026-47709 [MEDIUM] strukturag libheif up to 1.21.x Public C API heif_image_handle_get_image_tiling null pointer dereference (Nessus ID 333527)
A vulnerability categorized as problematic has been discovered in strukturag libheif up to 1.21.x. Impacted is the function heif_image_handle_get_image_tiling of the component Public C API. Executing a manipulation can lead to null pointer dereference.
This vulnerability appears as CVE-2026-47709. The attack may be performed from remote. There is no available exploit.
It is advisable to upgrade the affected component.
No detection rules found.
No public exploits indexed.
Bugzilla
libheif F43/F44 remain on vulnerable upstream versions despite existing Red Hat Product Security trackers
bugzilla·2026-09-18·CVSS 8.8
CVE-2026-32740 [HIGH] libheif F43/F44 remain on vulnerable upstream versions despite existing Red Hat Product Security trackers
libheif F43/F44 remain on vulnerable upstream versions despite existing Red Hat Product Security trackers
The Fedora 43 and Fedora 44 `libheif` packages appear to be behind multiple upstream security fixes that are already being tracked by Red Hat Product Security.
Current Fedora packages:
* Fedora 43: `libheif-1.20.2-6.fc43`
* Fedora 44: `libheif-1.21.2-1.fc44`
Multiple Red Hat Product Security trackers explicitly identify versions including Fedora's current 1.20.x/1.21.2 packages as affected.
Examples include:
* CVE-2026-32740 — Red Hat Bug 2479969
Affects `libheif` 1.21.2 and earlier; upstream fix in 1.22.0.
* CVE-2026-32741 — Red Hat Bug 2480002
Affects versions through 1.21.2; upstream fix in 1.22.0.
* CVE-2026-32814 — Red Hat Bug 2480001
Affects versions through 1.21.2; upstr
Bugzilla
CVE-2026-47709 libheif: libheif: Denial of Service via malformed HEIF image [fedora-all]
bugzilla·2026-07-22·CVSS 6.9
CVE-2026-47709 [MEDIUM] CVE-2026-47709 libheif: libheif: Denial of Service via malformed HEIF image [fedora-all]
CVE-2026-47709 libheif: libheif: Denial of Service via malformed HEIF image [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
libheif is a HEIF and AVIF file format decoder and encoder. Versions prior to 1.22.0 crashes in the public C API `heif_image_handle_get_image_tiling()` when a malformed uncompressed HEIF image item has an associated `uncC` property but no associated `ispe` property. In debug builds this trips the `ispe && uncC` assertion in `ImageItem_uncompressed::get_heif_image_tiling()`. In a release/NDEBUG ASan build, the same file causes a null pointer read at address `0xa8`. Version 1.22.0 f
Bugzilla
CVE-2026-47709 libheif: libheif: Denial of Service via malformed HEIF image [epel-all]
bugzilla·2026-07-22·CVSS 6.9
CVE-2026-47709 [MEDIUM] CVE-2026-47709 libheif: libheif: Denial of Service via malformed HEIF image [epel-all]
CVE-2026-47709 libheif: libheif: Denial of Service via malformed HEIF image [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
libheif is a HEIF and AVIF file format decoder and encoder. Versions prior to 1.22.0 crashes in the public C API `heif_image_handle_get_image_tiling()` when a malformed uncompressed HEIF image item has an associated `uncC` property but no associated `ispe` property. In debug builds this trips the `ispe && uncC` assertion in `ImageItem_uncompressed::get_heif_image_tiling()`. In a release/NDEBUG ASan build, the same file causes a null pointer read at address `0xa8`. Version 1.22.0 fix
Bugzilla
CVE-2026-47709 libheif: libheif: Denial of Service via malformed HEIF image
bugzilla·2026-07-21·CVSS 6.9
CVE-2026-47709 [MEDIUM] CVE-2026-47709 libheif: libheif: Denial of Service via malformed HEIF image
CVE-2026-47709 libheif: libheif: Denial of Service via malformed HEIF image
libheif is a HEIF and AVIF file format decoder and encoder. Versions prior to 1.22.0 crashes in the public C API `heif_image_handle_get_image_tiling()` when a malformed uncompressed HEIF image item has an associated `uncC` property but no associated `ispe` property. In debug builds this trips the `ispe && uncC` assertion in `ImageItem_uncompressed::get_heif_image_tiling()`. In a release/NDEBUG ASan build, the same file causes a null pointer read at address `0xa8`. Version 1.22.0 fixes the issue.
2026-07-21
Published