CVE-2026-47714
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
In libheif versions up to 1.21.2, an integer overflow occurs during inline mask processing in HEIF files. The product of width and height can exceed the maximum 32-bit unsigned value, leading to undersized buffer allocation and out-of-bounds memory access. The issue is fixed in version 1.22.0.
Risk Assessment
An attacker can remotely crash the application or potentially execute arbitrary code by providing a crafted HEIF/AVIF file.
Recommendation
Immediately update libheif to version 1.22.0 or later.
Other vulnerabilities in libheif
See all- CVE-2026-62377Medium
Vulnerability in libheif (up to 1.23.0) allows application crash via a crafted HEIF sequence that does not register sequence tracks, leading to assertion or undefined behavior when calling heif_context_get_track.
- CVE-2026-62292High
Vulnerability in libheif (versions 1.19.0 to 1.23.1) causing application crash when decoding a crafted uncompressed HEIF image with zlib compression. An offset calculation error leads to out-of-bounds read and crash.
- CVE-2026-62291Medium
Vulnerability in libheif (up to 1.23.0) allows heap corruption via a crafted image sequence with mismatched alpha plane dimensions, leading to out-of-bounds write during encoding.
- CVE-2026-62289Medium
Vulnerability in libheif (up to 1.23.0) allows crash or corrupt tiling results via a crafted HEIF/AVIF file with a clean aperture box that reduces dimensions to zero, causing underflow and assertion or incorrect results.
- CVE-2026-50142High
libheif from 1.19.0 to 1.23.0 has a vulnerability allowing unbounded heap allocation when processing a crafted HEIF sequence with msf1 brand. Box_stsz::parse() applies max_sequence_frames only to variable-size samples, and Track::load() uses 32-bit arithmetic that can bypass consistency checks. This can lead to gigabytes of memory allocation, crashing or stalling the process.
- CVE-2026-48029High
libheif versions 1.19.0 through 1.21.2 have a heap OOB read in ImageItem_Grid::decode_grid_tile via irot-induced tile-coordinate underflow. Version 1.22.0 fixes the issue.
- CVE-2026-47709Medium
Vulnerability in libheif before version 1.22.0. Decoding a malicious HEIF file without an `ispe` property (but with `uncC`) causes a crash in `heif_image_handle_get_image_tiling()` – via assertion in debug builds or null pointer read in release/ASan builds.
- CVE-2026-47254Medium
Vulnerability in libheif before version 1.22.0 causes a heap buffer overflow when reading HEIF/AVIF files. The Track::init_sample_timing_table() function stores an invalid chunk index, leading to an out-of-bounds read.
- CVE-2026-47251Medium
Vulnerability in libheif before version 1.22.0. The fix for CVE-2026-3949 introduced an integer overflow in the security check, allowing bypass and triggering an out-of-bounds heap read via a crafted HEIF file with a VVC track.
- CVE-2026-47247High
Two bugs in libheif prior to version 1.22.0 chain to leak process heap memory as visible pixel values in decoded grid images. An attacker uploading a crafted AVIF/HEIC file to a server-side image processor (WordPress, Sharp/libvips, ImageMagick, etc.) can recover heap data, including library function pointers sufficient to defeat ASLR, from publicly downloadable transcoded JPEG/PNG/WebP output.
Original NVD description (English source)
libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, the inline mask parsing code in `libheif/region.cc` contains an integer overflow. Both `width` and `height` are `unsigned int` (32-bit) values parsed from the HEIF file. Their product can exceed `UINT32_MAX`, wrapping to a small value before the division by 8. This causes an undersized buffer allocation, leading to out-of-bounds memory access when the mask data is later interpreted as a `width x height` bitmap. Version 1.22.0 patches the issue.