Description
libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, `Track::init_sample_timing_table()` in `libheif/sequences/track.cc` stores an out-of-bounds chunk index (`m_chunks.size()`) into `m_presentation_timeline` when the number of chunks defined in the `stco` box is less than the number of samples in `stsz`. A subsequent call to `heif_track_get_next_raw_sequence_sample()` reads `m_chunks[chunk_idx]` with that OOB index, causing a heap-buffer-overflow. Version 1.22.0 fixes the issue.
Published: 2026-07-21
Score: 6.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

libheif, a library for decoding and encoding HEIF and AVIF image formats, contains a flaw classified as CWE‑125. The bug arises when the chunk list is shorter than the sample list; an out‑of‑bounds index is stored and later read, producing a heap overflow that corrupts memory in the library’s heap structures. The vulnerability does not directly provide code execution, but the resulting memory corruption could potentially be leveraged in conjunction with other weaknesses.

Affected Systems

All installations of strukturag’s libheif prior to version 1.22.0 are affected. Applications that link to libheif 1.21 or earlier are vulnerable; the fix was released in version 1.22.0. No other vendors or products are listed as impacted.

Risk and Exploitability

Based on the description, it is inferred that an attacker must supply a crafted HEIF or AVIF file to trigger the overflow during decoding. The CVSS score of 6.1 reflects moderate severity. The EPSS value of less than 1 % indicates that the vulnerability is currently unlikely to be widely exploited. It is not listed in the CISA KEV catalog. No public exploits have been reported, and updating to the patched release mitigates the issue.

Generated by OpenCVE AI on July 30, 2026 at 16:14 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade libheif to version 1.22.0 or newer
  • If an upgrade is not possible, avoid processing untrusted HEIF or AVIF files with the vulnerable library
  • Consider disabling or replacing libheif in applications that handle external media

Generated by OpenCVE AI on July 30, 2026 at 16:14 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Ubuntu USN Ubuntu USN USN-8526-1 libheif vulnerabilities
History

Mon, 27 Jul 2026 23:30:00 +0000

Type Values Removed Values Added
First Time appeared Struktur
Struktur libheif
Vendors & Products Struktur
Struktur libheif

Wed, 22 Jul 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 21 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Description libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, `Track::init_sample_timing_table()` in `libheif/sequences/track.cc` stores an out-of-bounds chunk index (`m_chunks.size()`) into `m_presentation_timeline` when the number of chunks defined in the `stco` box is less than the number of samples in `stsz`. A subsequent call to `heif_track_get_next_raw_sequence_sample()` reads `m_chunks[chunk_idx]` with that OOB index, causing a heap-buffer-overflow. Version 1.22.0 fixes the issue.
Title libheif Has Heap Buffer Overflow in `Track::get_next_sample_raw_data()` -- OOB Chunk Vector Access
Weaknesses CWE-125
References
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H'}

Subscriptions

Struktur Libheif
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-07-22T18:24:43.175Z

Reserved: 2026-05-18T22:54:18.273Z

Link: CVE-2026-47254

cve-icon Vulnrichment

Updated: 2026-07-22T18:20:13.806Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-30T16:15:04Z

Weaknesses