libheif has Heap Out Of Bounds Write in unci subsystem
CVE-2026-47178

6.1MEDIUM

Key Information:

Vendor

Strukturag

Status
Libheif
Vendor
CVE Published:
21 July 2026

What is CVE-2026-47178?

libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.19.0 through 1.21.2, a crafted HEIF file (uncompressed unci codec, tiled, component-interleaved, 4:2:0) triggers a heap out-of-bounds write in libheif's uncompressed tile decoder. The write overwrites the C++ vtable pointer of an adjacent unc_decoder_component_interleave object; the next virtual call dispatches to an attacker-chosen address. Version 1.22.0 patches the issue.

Affected Version(s)

libheif >= 1.19.0, < 1.22.0

References

https://github.com/strukturag/libheif/security/advisories...
x_refsource_CONFIRM

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.