6.8
Medium
CVE-2026-47251 libheif is a HEIF and AVIF file format decoder and encoder
Description
libheif is a HEIF and AVIF file format decoder and encoder. The fix for CVE-2026-3949 (commit `b97c8b5`, PR #1712) introduced an integer overflow in the very security check it added. The check itself can be bypassed, allowing a crafted HEIF file with a VVC track to trigger the same out-of-bounds heap read that CVE-2026-3949 was meant to prevent. This is a separate, currently-unpatched vulnerability. Issue #1712 was closed as fixed without testing the edge case where `size` is near `UINT32_MAX`. Version 1.22.0 patches the issue.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| libheif 1.22 | earliest → < 1.22.0 | 1.22.0 |
Other CVEs of libheif
The 34 CVEs of libheif →
CVE-2026-120208
libheif 1.18.0 before 1.23.3 contains a heap-based buffer overflow vulnerability in…
7.7
High
CVE-2026-84450
libheif is a HEIF and AVIF file format decoder and encoder
4.3
Medium
CVE-2026-84449
libheif is a HEIF and AVIF file format decoder and encoder
3.7
Low
CVE-2026-84451
libheif is a HEIF and AVIF file format decoder and encoder
6.5
Medium