CVE-2026-47247: struktur libheif

Vulnerability summary

CVE-2026-47247 is a high (CVSS 7.5) vulnerability in struktur libheif. EPSS estimates a 0.48% chance of exploitation in the next 30 days, higher than 40% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 21-07-2026
   PublishedVulnerability first disclosed.
2. 22-07-2026
   Last modifiedVulnerability information updated.

Description

libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, two bugs in libheif chain to leak process heap memory as visible pixel values in decoded grid images. An attacker who uploads a crafted AVIF/HEIC file to any server-side image processor (WordPress, Sharp/libvips, ImageMagick, etc.) can recover heap data - including library function pointers sufficient to defeat ASLR, or any other secret - from the publicly-downloadable transcoded JPEG/PNG/WebP output. Local attack vectors are also possible. Version 1.22.0 fixes the issue.

• CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
• CWE-226Sensitive Information in Resource Not Removed Before ReuseThe product releases a resource such as memory or a file so that it can be made available for reuse, but it does not clear or "zeroize" the information contained in the resource before the product performs a critical state transition or makes the resource available for reuse by other entities.
• CWE-682Incorrect CalculationThe product performs a calculation that generates incorrect or unintended results that are later used in security-critical decisions or resource management.
• CWE-908Use of Uninitialized ResourceThe product uses or accesses a resource that has not been initialized.