CVE-2026-47254 Overview
CVE-2026-47254 is a heap-buffer-overflow vulnerability in libheif, an open-source HEIF and AVIF file format decoder and encoder. The flaw affects all versions prior to 1.22.0 and is classified under [CWE-125] (Out-of-Bounds Read). The vulnerability resides in the sequence track handling logic, specifically in Track::init_sample_timing_table() within libheif/sequences/track.cc. A malformed HEIF or AVIF file containing mismatched stco and stsz box entries can trigger an out-of-bounds memory access when the file is decoded. Exploitation requires local access and user interaction, such as opening a crafted media file with an application that links against a vulnerable libheif build.
Critical Impact
Processing a crafted HEIF/AVIF file can cause a heap-buffer-overflow read, leading to application crash or potential information disclosure.
Affected Products
- libheif versions prior to 1.22.0
- Applications and libraries that embed vulnerable libheif builds for HEIF/AVIF decoding
- Linux distributions shipping libheif as a system library
Discovery Timeline
- 2026-07-21 - CVE-2026-47254 published to NVD
- 2026-07-22 - Last updated in NVD database
Technical Details for CVE-2026-47254
Vulnerability Analysis
The vulnerability is an out-of-bounds read in libheif's sequence track parsing code. During initialization of the sample timing table, Track::init_sample_timing_table() populates m_presentation_timeline with chunk indices derived from parsed ISO Base Media File Format boxes. When the stco (chunk offset) box declares fewer chunks than the number of samples reported by the stsz (sample size) box, the routine stores m_chunks.size() as a chunk index rather than clamping or rejecting the malformed input. This stored index is one past the last valid element of m_chunks.
Root Cause
The root cause is missing bounds validation between the stco and stsz box entries. libheif assumes a consistent relationship between chunk count and sample count but does not enforce it during table initialization. As a result, the presentation timeline records an invalid chunk index equal to m_chunks.size(), which is not a legal subscript into the container.
Attack Vector
An attacker crafts a HEIF or AVIF file whose ISO BMFF metadata declares more samples in stsz than chunks in stco. When a victim opens the file in an application that uses libheif, the decoder calls heif_track_get_next_raw_sequence_sample(), which dereferences m_chunks[chunk_idx] with the out-of-bounds index. The read accesses adjacent heap memory, causing a crash or potential leakage of process memory contents. The CVSS vector indicates a local attack requiring user interaction, with high impact on availability and limited impact on confidentiality.
No verified public exploitation code is available. For technical details, see the GitHub Security Advisory.
Detection Methods for CVE-2026-47254
Indicators of Compromise
- Application crashes or abnormal terminations in processes that decode HEIF or AVIF files
- Heap corruption signatures reported by AddressSanitizer or similar runtime memory checkers when processing untrusted media
- Presence of HEIF/AVIF files with inconsistent stco and stsz box entry counts
Detection Strategies
- Inventory installed libheif versions across endpoints and build pipelines to identify releases prior to 1.22.0
- Scan software bills of materials (SBOMs) for downstream applications that statically link vulnerable libheif builds
- Fuzz test HEIF/AVIF parsing paths in third-party applications to surface latent boundary violations
Monitoring Recommendations
- Monitor endpoint telemetry for repeated crashes of image viewers, thumbnailers, or media processing services
- Alert on unusual process termination patterns following HEIF or AVIF file access
- Track file ingestion pipelines that accept user-supplied media for anomalous parsing failures
How to Mitigate CVE-2026-47254
Immediate Actions Required
- Upgrade libheif to version 1.22.0 or later on all systems and container images
- Rebuild and redistribute any application that statically links libheif once the updated library is available
- Restrict processing of untrusted HEIF and AVIF files until patched builds are deployed
Patch Information
libheif version 1.22.0 fixes the issue by correctly handling cases where the number of chunks declared in the stco box is less than the number of samples declared in stsz. Refer to the upstream GitHub Security Advisory GHSA-wqjg-4x9g-6cvg for release details.
Workarounds
- Disable HEIF and AVIF decoding in applications that expose libheif to untrusted input where feasible
- Sandbox media decoding processes to limit the impact of heap corruption
- Filter incoming files at gateways to block HEIF and AVIF content from untrusted sources until systems are patched
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
