CVE-2026-47714
published 2026-07-21CVE-2026-47714: libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, the inline mask parsing code in `libheif/region.cc` contains an…
PriorityP426medium6.1CVSS 3.1
AVLACLPRNUIRSUCLINAH
EPSS
0.11%
1.3th percentile
libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, the inline mask parsing code in `libheif/region.cc` contains an integer overflow. Both `width` and `height` are `unsigned int` (32-bit) values parsed from the HEIF file. Their product can exceed `UINT32_MAX`, wrapping to a small value before the division by 8. This causes an undersized buffer allocation, leading to out-of-bounds memory access when the mask data is later interpreted as a `width x height` bitmap. Version 1.22.0 patches the issue.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| struktur | libheif | < 1.22.0 | 1.22.0 |
| strukturag | libheif | < 1.22.0 | 1.22.0 |
| ubuntu | libheif | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
libheif vulnerabilities
vendor_ubuntu·2026-07-14
CVE-2026-47714 libheif vulnerabilities
Title: libheif vulnerabilities
Summary: Several security issues were fixed in libheif.
USN-8526-1 fixed vulnerabilities in libheif. This update provides the
corresponding updates for CVE-2026-47709 and CVE-2026-47714 in
Ubuntu 24.04 LTS.
Original advisory details:
Junyi Liu discovered that libheif had a null pointer dereference in its
image tiling interface. An attacker could possibly use this issue to
cause a denial of service. (CVE-2026-47709)
Calvin Young and Enoch Chow discovered that libheif had an integer
overflow in its inline mask size calculation. An attacker could
possibly use this issue to cause a denial of service or obtain sensitive
information. (CVE-2026-47714)
Instructions: In general, a standard system update will make all the necessary
changes.
Ubuntu
libheif vulnerabilities
vendor_ubuntu·2026-07-09
CVE-2026-47709 libheif vulnerabilities
Title: libheif vulnerabilities
Summary: Several security issues were fixed in libheif.
Xianrui Dong discovered that libheif had an out-of-bounds read in its
HEIF sequence track parser. An attacker could possibly use this issue
to cause a denial of service or obtain sensitive information. This issue
only affected Ubuntu 26.04 LTS. (CVE-2026-47254)
Junyi Liu discovered that libheif had a null pointer dereference in its
image tiling interface. An attacker could possibly use this issue to
cause a denial of service. (CVE-2026-47709)
Calvin Young and Enoch Chow discovered that libheif had an integer
overflow in its inline mask size calculation. An attacker could
possibly use this issue to cause a denial of service or obtain sensitive
information. (CVE-2026-47714)
Ariel Koren discovered that
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-47714 libheif: libheif: Denial of service and information disclosure via integer overflow in inline mask parsing [fedora-all]
bugzilla·2026-07-22·CVSS 6.1
CVE-2026-47714 [MEDIUM] CVE-2026-47714 libheif: libheif: Denial of service and information disclosure via integer overflow in inline mask parsing [fedora-all]
CVE-2026-47714 libheif: libheif: Denial of service and information disclosure via integer overflow in inline mask parsing [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, the inline mask parsing code in `libheif/region.cc` contains an integer overflow. Both `width` and `height` are `unsigned int` (32-bit) values parsed from the HEIF file. Their product can exceed `UINT32_MAX`, wrapping to a small value before the division by 8. This causes an undersized buffer allocation, leading to out-of-bounds memory access when
Bugzilla
CVE-2026-47714 libheif: libheif: Denial of service and information disclosure via integer overflow in inline mask parsing [epel-all]
bugzilla·2026-07-22·CVSS 6.1
CVE-2026-47714 [MEDIUM] CVE-2026-47714 libheif: libheif: Denial of service and information disclosure via integer overflow in inline mask parsing [epel-all]
CVE-2026-47714 libheif: libheif: Denial of service and information disclosure via integer overflow in inline mask parsing [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, the inline mask parsing code in `libheif/region.cc` contains an integer overflow. Both `width` and `height` are `unsigned int` (32-bit) values parsed from the HEIF file. Their product can exceed `UINT32_MAX`, wrapping to a small value before the division by 8. This causes an undersized buffer allocation, leading to out-of-bounds memory access when t
Bugzilla
CVE-2026-47714 libheif: libheif: Denial of service and information disclosure via integer overflow in inline mask parsing
bugzilla·2026-07-21·CVSS 6.1
CVE-2026-47714 [MEDIUM] CVE-2026-47714 libheif: libheif: Denial of service and information disclosure via integer overflow in inline mask parsing
CVE-2026-47714 libheif: libheif: Denial of service and information disclosure via integer overflow in inline mask parsing
libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, the inline mask parsing code in `libheif/region.cc` contains an integer overflow. Both `width` and `height` are `unsigned int` (32-bit) values parsed from the HEIF file. Their product can exceed `UINT32_MAX`, wrapping to a small value before the division by 8. This causes an undersized buffer allocation, leading to out-of-bounds memory access when the mask data is later interpreted as a `width x height` bitmap. Version 1.22.0 patches the issue.
2026-07-21
Published