Back to overview

CVE-2026-47247

HIGH
7.5
CVSS 3.1
Description
libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, two bugs in libheif chain to leak process heap memory as visible pixel values in decoded grid images. An attacker who uploads a crafted AVIF/HEIC file to any server-side image processor (WordPress, Sharp/libvips, ImageMagick, etc.) can recover heap data - including library function pointers sufficient to defeat ASLR, or any other secret - from the publicly-downloadable transcoded JPEG/PNG/WebP output. Local attack vectors are also possible. Version 1.22.0 fixes the issue.

Metadata

CVE ID
CVE-2026-47247
State
PUBLISHED
Assigner
GitHub_M
Reserved
2026-05-18 22:54 UTC
Published
2026-07-21 21:16 UTC
Last updated
2026-07-21 21:16 UTC
Primary CWE
CWE-200
CWE-200: Exposure of Sensitive Information to an Unauthorize…
Vendor / Product
strukturag / libheif
Sources
cve.org  ·  NVD

Severity & Metrics

7.5 HIGH CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products (1)
VendorProductPlatformVersions
strukturag libheif — < 1.22.0
Weakness (CWE)
CWESourceDescription
CWE-200 cna CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-226 cna CWE-226: Sensitive Information in Resource Not Removed Before Reuse
CWE-682 cna CWE-682: Incorrect Calculation
CWE-908 cna CWE-908: Use of Uninitialized Resource
CVSS scores (1)
ScoreSeverityVersionSourceVector
7.5 HIGH 3.1 cna CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References (1)
Back to overview