CVE-2026-47254: struktur libheif Out-of-bounds Read
Vulnerability summary
CVE-2026-47254 is a medium (CVSS 6.1) Out-of-bounds Read vulnerability in struktur libheif. EPSS estimates a 0.16% chance of exploitation in the next 30 days, higher than 4.9% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 4 · Related 5Timeline
- 21-07-2026PublishedVulnerability first disclosed.
- 22-07-2026Last modifiedVulnerability information updated.
Description
libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, `Track::init_sample_timing_table()` in `libheif/sequences/track.cc` stores an out-of-bounds chunk index (`m_chunks.size()`) into `m_presentation_timeline` when the number of chunks defined in the `stco` box is less than the number of samples in `stsz`. A subsequent call to `heif_track_get_next_raw_sequence_sample()` reads `m_chunks[chunk_idx]` with that OOB index, causing a heap-buffer-overflow. Version 1.22.0 fixes the issue.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
- OSV · DebianEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
- NVDNIST6.1MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
EPSS trend
Probability
0.16%
Chance of exploitation in the next 30 days
Percentile
5%
Versus all other CVEs
30-day change
-0.03 pp
From 0.19% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundLibheif
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Debian1 product
- libheifAll versions (No fix recorded) | < 1.23.1-1
Struktur1 product
- libheif< 1.22.0
Strukturag1 product
- libheif< 1.22.0
Ubuntu1 product
- libheif< 1.21.2-3ubuntu0.3
4 vendors · 4 products
References
5 links- github.com/strukturag/libheif/security/advisories/GHSA-wqjg-4x9g-6cvgX Refsource CONFIRMREPORTExploitMitigationVendor Advisory
