CVE-2026-47709

MEDIUM

libheif has a NULL pointer dereference in heif_image_handle_get_image_tiling for malformed unci image missing ispe

Title source: cna
STIX 2.1

Description

libheif is a HEIF and AVIF file format decoder and encoder. Versions prior to 1.22.0 crashes in the public C API `heif_image_handle_get_image_tiling()` when a malformed uncompressed HEIF image item has an associated `uncC` property but no associated `ispe` property. In debug builds this trips the `ispe && uncC` assertion in `ImageItem_uncompressed::get_heif_image_tiling()`. In a release/NDEBUG ASan build, the same file causes a null pointer read at address `0xa8`. Version 1.22.0 fixes the issue.

References (3)

Core 3
Core References
X_Refsource_Misc x_refsource_misc
https://github.com/strukturag/libheif/issues/1802
X_Refsource_Misc x_refsource_misc
https://github.com/strukturag/libheif/pull/1806

Scores

CVSS v3 5.5
EPSS 0.0021
EPSS Percentile 11.7%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-476
Status published
Products (2)
struktur/libheif < 1.22.0
strukturag/libheif < 1.22.0
Published Jul 21, 2026
Tracked Since Jul 22, 2026