CVEFinder.io

CVE-2026-47254

🔶 medium
🔍 Scan for this CVE
Summary

libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, `Track::init_sample_timing_table()` in `libheif/sequences/track.cc` stores an out-of-bounds chunk index (`m_chunks.size()`) into `m_presentation_timeline` when the number of chunks defined in the `stco` box is less than the number of samples in `stsz`. A subsequent call to `heif_track_get_next_raw_sequence_sample()` reads `m_chunks[chunk_idx]` with that OOB index, causing a heap-buffer-overflow. Version 1.22.0 f

Description

libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, `Track::init_sample_timing_table()` in `libheif/sequences/track.cc` stores an out-of-bounds chunk index (`m_chunks.size()`) into `m_presentation_timeline` when the number of chunks defined in the `stco` box is less than the number of samples in `stsz`. A subsequent call to `heif_track_get_next_raw_sequence_sample()` reads `m_chunks[chunk_idx]` with that OOB index, causing a heap-buffer-overflow. Version 1.22.0 fixes the issue.

CVSS Score
6.1
Medium
EPSS Score
0.2
Exploit Probability
Published Date
2026-07-21
First Seen: 2026-07-22
📊 Relative Risk Intelligence

This CVE is Lower Risk - more severe than 37.7% of all 349,016 vulnerabilities in our database.

#217,357
Below average severity
Severity Percentile
🎯 CISA SSVC Assessment Updated: Jul 22, 2026
🔍 Exploitation Status
None
No known exploits
⚙️ Automatable
NO
Requires human interaction
💥 Technical Impact
Partial
Limited system impact
SSVC data provided by CISA
Last Modified 2026-07-27
Source NVD 🔗
CVSS Vector 3.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
CWE IDs (Weakness Types)
CWE-125

📦 Affected Products 1

Vendor Product Status Affected Versions
struktur libheif Affected
< 1.22.0

🔗 References 1

https://github.com/strukturag/libheif/security/advis...
Exploit Mitigation Vendor Advisory

🔗 Related CVEs 6

CVE ID Severity CVSS EPSS Summary Published
CVE-2026-48029 ⚠️ high 7.1 0.3 libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.19.0 through 1.21.2 have a heap OOB read in Image... 2026-07-22
CVE-2026-47714 🔶 medium 6.1 0.1 libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, the inline mask parsing code i... 2026-07-21
CVE-2026-47178 🔶 medium 6.1 0.2 libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.19.0 through 1.21.2, a crafted HEIF file (unco... 2026-07-21
CVE-2026-47247 ⚠️ high 7.5 0.5 libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, two bugs in libheif chain to leak p... 2026-07-21
CVE-2026-47251 🔶 medium 6.1 0.2 libheif is a HEIF and AVIF file format decoder and encoder. The fix for CVE-2026-3949 (commit `b97c8b5`, PR #1712) intro... 2026-07-21
CVE-2026-47709 🔶 medium 5.5 0.2 libheif is a HEIF and AVIF file format decoder and encoder. Versions prior to 1.22.0 crashes in the public C API `heif_i... 2026-07-21
These CVEs affect the same products