What’s Vulnerable › Vulnerabilities
CVE-2026-47254: libheif Has Heap Buffer Overflow in `Track::get_next_sample_raw_data()` -- OOB Chunk Vector Access
- Severity: medium (CVSS 6.1 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2026-07-21 · updated 2026-10-24
- Weakness: CWE-125
Description
libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, `Track::init_sample_timing_table()` in `libheif/sequences/track.cc` stores an out-of-bounds chunk index (`m_chunks.size()`) into `m_presentation_timeline` when the number of chunks defined in the `stco` box is less than the number of samples in `stsz`. A subsequent call to `heif_track_get_next_raw_sequence_sample()` reads `m_chunks[chunk_idx]` with that OOB index, causing a heap-buffer-overflow. Version 1.22.0 fixes the issue.
Affected products
- strukturag libheif: before 1.22.0 — fixed in 1.22.0
How to fix
Upgrade to a fixed version: strukturag libheif 1.22.0. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-47254 or the next vulnerability affects your stack