CVE-2026-47247

libheif Vulnerable to Heap Information Disclosure via Grid Image Gap + Uninitialized Pixel Plane Allocation

State: Published
Severity: 7.5 High
Published: Jul 21, 2026
Updated: Jul 22, 2026
Reserved: May 18, 2026

Description

libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, two bugs in libheif chain to leak process heap memory as visible pixel values in decoded grid images. An attacker who uploads a crafted AVIF/HEIC file to any server-side image processor (WordPress, Sharp/libvips, ImageMagick, etc.) can recover heap data - including library function pointers sufficient to defeat ASLR, or any other secret - from the publicly-downloadable transcoded JPEG/PNG/WebP output. Local attack vectors are also possible. Version 1.22.0 fixes the issue.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	GitHub_M

Weaknesses

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CWE-226 Sensitive Information in Resource Not Removed Before Reuse
CWE-682 Incorrect Calculation
CWE-908 Use of Uninitialized Resource

Affected Products

Product	Versions
libheifstrukturag	< 1.22.0Affected

References

https://github.com/strukturag/libheif/security/advisories/GHSA-2vh6-whr3-cmq3

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.