Vulnerability · Published Jul 21, 2026 · Assigned by GitHub_M

CVE-2026-47247libheif Vulnerable to Heap Information Disclosure via Grid Image Gap + Uninitialized Pixel Plane Allocation

High 7.5

In plain English

A high-severity information exposure in libheif from strukturag. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.5%top 58.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, two bugs in libheif chain to leak process heap memory as visible pixel values in decoded grid images. An attacker who uploads a crafted AVIF/HEIC file to any server-side image processor (WordPress, Sharp/libvips, ImageMagick, etc.) can recover heap data - including library function pointers sufficient to defeat ASLR, or any other secret - from the publicly-downloadable transcoded JPEG/PNG/WebP output. Local attack vectors are also possible. Version 1.22.0 fixes the issue.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	libheif	no fix listed	DEBIAN-CVE-2026-47247
Debian:13	libheif	1.19.8-1+deb13u1	DEBIAN-CVE-2026-47247
Debian:14	libheif	1.23.1-1	DEBIAN-CVE-2026-47247
Ubuntu:24.04:LTS	libheif	1.17.6-1ubuntu4.4	UBUNTU-CVE-2026-47247
Ubuntu:25.10	libheif	1.20.2-1ubuntu0.4	UBUNTU-CVE-2026-47247
Ubuntu:26.04:LTS	libheif	1.21.2-3ubuntu0.1	UBUNTU-CVE-2026-47247

Affected products (as reported)

Vendor	Product	Versions
strukturag	libheif	< 1.22.0

Weakness: CWE-200, CWE-226, CWE-682, CWE-908 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

https://github.com/strukturag/libheif/security/advisories/GHSA-2vh6-whr3-cmq3 x_refsource_CONFIRM