CVE-2026-47251: libheif has an incomplete fix for CVE-2026-3949: integer overflow bypass in vvdec_push_data2
libheif is a HEIF and AVIF file format decoder and encoder. The fix for CVE-2026-3949 (commit b97c8b5, PR #1712) introduced an integer overflow in the very security check it added. The check itself can be bypassed, allowing a crafted HEIF file with a VVC track to trigger the same out-of-bounds heap read that CVE-2026-3949 was meant to prevent. This is a separate, currently-unpatched vulnerability. Issue #1712 was closed as fixed without testing the edge case where size is near UINT32MAX. Version 1.22.0 patches the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
libheifto a version that resolves this vulnerability.Fixed in 1.22.0Patch PR #1712 - Compensating control
If you must process untrusted HEIF/AVIF content until libheif 1.22.0 is deployed, isolate or sandbox the libheif decoding process (e.g., run in a restricted container/sandbox) to limit impact from a potential out-of-bounds heap read.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-47251?
CVE-2026-47251 has a medium severity rating of 6.8.
What vulnerability does CVE-2026-47251 address?
CVE-2026-47251 relates to an incomplete fix for CVE-2026-3949 that allows integer overflow bypass in libheif.
How do I fix CVE-2026-47251?
To fix CVE-2026-47251, update to the latest version of libheif where the integer overflow issue is properly addressed.
What software is affected by CVE-2026-47251?
CVE-2026-47251 affects libheif in Futo and struktur implementations.
What kind of exploit does CVE-2026-47251 enable?
CVE-2026-47251 potentially allows crafted HEIF files to trigger out-of-bounds access due to integer overflow.