Vulnerability · Published Jul 21, 2026 · Assigned by GitHub_M

CVE-2026-47178libheif has Heap Out Of Bounds Write in unci subsystem

Medium 6.1

In plain English

A medium-severity out-of-bounds write in libheif from strukturag. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.1Medium

Exploit odds (30 days)0.2%top 92.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.19.0 through 1.21.2, a crafted HEIF file (uncompressed `unci` codec, tiled, component-interleaved, 4:2:0) triggers a heap out-of-bounds write in libheif's uncompressed tile decoder. The write overwrites the C++ vtable pointer of an adjacent `unc_decoder_component_interleave` object; the next virtual call dispatches to an attacker-chosen address. Version 1.22.0 patches the issue.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	libheif	no fix listed	DEBIAN-CVE-2026-47178
Debian:13	libheif	1.19.8-1+deb13u1	DEBIAN-CVE-2026-47178
Debian:14	libheif	1.23.1-1	DEBIAN-CVE-2026-47178
Ubuntu:25.10	libheif	1.20.2-1ubuntu0.5	UBUNTU-CVE-2026-47178
Ubuntu:26.04:LTS	libheif	1.21.2-3ubuntu0.2	UBUNTU-CVE-2026-47178

Affected products (as reported)

Vendor	Product	Versions
strukturag	libheif	>= 1.19.0, < 1.22.0

Weakness: CWE-787 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

References

https://github.com/strukturag/libheif/security/advisories/GHSA-5x55-x5pf-9c6g x_refsource_CONFIRM