CVE-2026-47178: struktur libheif Out-of-bounds Write
Vulnerability summary
CVE-2026-47178 is a high (CVSS 7.8) Out-of-bounds Write vulnerability in struktur libheif. EPSS estimates a 0.18% chance of exploitation in the next 30 days, higher than 7.4% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 5 · Related 5Timeline
- 21-07-2026PublishedVulnerability first disclosed.
- 22-07-2026Last modifiedVulnerability information updated.
Description
libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.19.0 through 1.21.2, a crafted HEIF file (uncompressed `unci` codec, tiled, component-interleaved, 4:2:0) triggers a heap out-of-bounds write in libheif's uncompressed tile decoder. The write overwrites the C++ vtable pointer of an adjacent `unc_decoder_component_interleave` object; the next virtual call dispatches to an attacker-chosen address. Version 1.22.0 patches the issue.
CVSS metrics
4 scores · 4 sources · 1 version- CVE.orgCNA6.1MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:HDiffers
- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.18%
Chance of exploitation in the next 30 days
Percentile
7%
Versus all other CVEs
30-day change
-0.02 pp
From 0.20% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundLibheif
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Debian1 product
- libheifAll versions (No fix recorded) | < 1.19.8-1+deb13u1 | < 1.23.1-1
Struktur1 product
- libheif≥ 1.19.0, < 1.22.0
Strukturag1 product
- libheif≥ 1.19.0, < 1.22.0
Ubuntu1 product
- libheif< 1.20.2-1ubuntu0.5 | < 1.21.2-3ubuntu0.2
4 vendors · 4 products
References
6 links- github.com/strukturag/libheif/security/advisories/GHSA-5x55-x5pf-9c6gX Refsource CONFIRMREPORTExploitVendor Advisory
