Heap Out-of-Bounds Write in libheif Affects Multiple Versions
CVE-2026-47178

6.1MEDIUM

Key Information:

Vendor

Strukturag

Status
Libheif
Vendor
CVE Published:
21 July 2026

What is CVE-2026-47178?

The libheif library, used for HEIF and AVIF file format encoding and decoding, is vulnerable to a heap out-of-bounds write due to improper handling of crafted HEIF files in versions 1.19.0 to 1.21.2. This vulnerability occurs when a specially designed uncompressed unci codec, tiled, component-interleaved 4:2:0 file is processed, leading to an overwrite of the C++ vtable pointer of an adjacent unc_decoder_component_interleave object. If exploited, this can allow attackers to control the flow of execution, potentially resulting in arbitrary code execution. The vulnerability was addressed in version 1.22.0.

Affected Version(s)

libheif >= 1.19.0, < 1.22.0

References

https://github.com/strukturag/libheif/security/advisories...
x_refsource_CONFIRM

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.