Back to overview

CVE-2026-47709

MEDIUM
6.9
CVSS 4.0
Description
libheif is a HEIF and AVIF file format decoder and encoder. Versions prior to 1.22.0 crashes in the public C API `heif_image_handle_get_image_tiling()` when a malformed uncompressed HEIF image item has an associated `uncC` property but no associated `ispe` property. In debug builds this trips the `ispe && uncC` assertion in `ImageItem_uncompressed::get_heif_image_tiling()`. In a release/NDEBUG ASan build, the same file causes a null pointer read at address `0xa8`. Version 1.22.0 fixes the issue.

Metadata

CVE ID
CVE-2026-47709
State
PUBLISHED
Assigner
GitHub_M
Reserved
2026-05-19 21:29 UTC
Published
2026-07-21 21:31 UTC
Last updated
2026-07-21 21:31 UTC
Primary CWE
CWE-476
CWE-476: NULL Pointer Dereference
Vendor / Product
strukturag / libheif
Sources
cve.org  ·  NVD

Severity & Metrics

6.9 MEDIUM CVSS 4.0
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected products (1)
VendorProductPlatformVersions
strukturag libheif — < 1.22.0
Weakness (CWE)
CWESourceDescription
CWE-476 cna CWE-476: NULL Pointer Dereference
CVSS scores (1)
ScoreSeverityVersionSourceVector
6.9 MEDIUM 4.0 cna CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
References (3)
Back to overview