CVE-2026-47251

libheif is a HEIF and AVIF file format decoder and encoder. The fix for CVE-2026-3949 (commit `b97c8b5`, PR #1712) introduced an integer overflow in the very security check it added. The check itself can be bypassed, allowing a crafted HEIF file with a VVC track to trigger the same out-of-bounds heap read that CVE-2026-3949 was meant to prevent. This is a separate, currently-unpatched vulnerability. Issue #1712 was closed as fixed without testing the edge case where `size` is near `UINT32_MAX`. Version 1.22.0 patches the issue.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 4.2

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/strukturag/libheif/issues/1712	Issue Tracking
https://github.com/strukturag/libheif/security/advisories/GHSA-p6q9-fhf2-vj9v	Exploit Vendor Advisory
https://github.com/strukturag/libheif/issues/1712	Issue Tracking
https://github.com/strukturag/libheif/security/advisories/GHSA-p6q9-fhf2-vj9v	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:struktur:libheif:*:*:*:*:*:*:*:*

History

24 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) libheif es un decodificador y codificador de formato de archivo HEIF y AVIF. La solución para CVE-2026-3949 (commit ’b97c8b5’, PR #1712) introdujo un desbordamiento de entero en la misma comprobación de seguridad que añadió. La comprobación en sí puede ser eludida, permitiendo que un archivo HEIF manipulado con una pista VVC active la misma lectura de montón fuera de límites que CVE-2026-3949 pretendía evitar. Esta es una vulnerabilidad separada y actualmente sin parchear. El problema #1712 se cerró como solucionado sin probar el caso límite donde ’size’ está cerca de ’UINT32_MAX’. La versión 1.22.0 parchea el problema.

Information

Published : 2026-07-21 22:17

Updated : 2026-10-24 19:10

NVD link : CVE-2026-47251

Mitre link : CVE-2026-47251

CVE.ORG link : CVE-2026-47251

JSON object : View

Products Affected

struktur

libheif

CWE

CWE-125

Out-of-bounds Read

CWE-190

Integer Overflow or Wraparound

{"id": "CVE-2026-47251", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-47251", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-22T13:38:27.784638Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 4.2, "exploitabilityScore": 1.8}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.8, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "strukturag", "product": "libheif", "versions": [{"status": "affected", "version": "< 1.22.0"}]}]}], "published": "2026-07-21T22:17:12.800", "references": [{"url": "https://github.com/strukturag/libheif/issues/1712", "tags": ["Issue Tracking"], "source": "security-advisories@github.com"}, {"url": "https://github.com/strukturag/libheif/security/advisories/GHSA-p6q9-fhf2-vj9v", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/strukturag/libheif/issues/1712", "tags": ["Issue Tracking"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}, {"url": "https://github.com/strukturag/libheif/security/advisories/GHSA-p6q9-fhf2-vj9v", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-125"}, {"lang": "en", "value": "CWE-190"}]}], "descriptions": [{"lang": "en", "value": "libheif is a HEIF and AVIF file format decoder and encoder. The fix for CVE-2026-3949 (commit `b97c8b5`, PR #1712) introduced an integer overflow in the very security check it added. The check itself can be bypassed, allowing a crafted HEIF file with a VVC track to trigger the same out-of-bounds heap read that CVE-2026-3949 was meant to prevent. This is a separate, currently-unpatched vulnerability. Issue #1712 was closed as fixed without testing the edge case where `size` is near `UINT32_MAX`. Version 1.22.0 patches the issue."}, {"lang": "es", "value": "libheif es un decodificador y codificador de formato de archivo HEIF y AVIF. La soluci\u00f3n para CVE-2026-3949 (commit \u2019b97c8b5\u2019, PR #1712) introdujo un desbordamiento de entero en la misma comprobaci\u00f3n de seguridad que a\u00f1adi\u00f3. La comprobaci\u00f3n en s\u00ed puede ser eludida, permitiendo que un archivo HEIF manipulado con una pista VVC active la misma lectura de mont\u00f3n fuera de l\u00edmites que CVE-2026-3949 pretend\u00eda evitar. Esta es una vulnerabilidad separada y actualmente sin parchear. El problema #1712 se cerr\u00f3 como solucionado sin probar el caso l\u00edmite donde \u2019size\u2019 est\u00e1 cerca de \u2019UINT32_MAX\u2019. La versi\u00f3n 1.22.0 parchea el problema."}], "lastModified": "2026-10-24T19:10:00.127", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:struktur:libheif:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CB01CAAF-1D64-461B-8CC0-3CF2FBAC60A5", "versionEndExcluding": "1.22.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}