CVE-2026-47254: libheif Has Heap Buffer Overflow in `Track::get_next_sample_raw_data()` -- OOB Chunk Vector Access
Last updated 10 July 2026
Other sources
libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, Track::initsampletimingtable() in libheif/sequences/track.cc stores an out-of-bounds chunk index (mchunks.size()) into mpresentationtimeline when the number of chunks defined in the stco box is less than the number of samples in stsz. A subsequent call to heiftrackgetnextrawsequencesample() reads mchunks[chunkidx] with that OOB index, causing a heap-buffer-overflow. Version 1.22.0 fixes the issue.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/libheifto a version that resolves this vulnerability.Fixed in 1.23.1-1 - Upgrade
Upgrade
libheifto a version that resolves this vulnerability.Fixed in 1.22.0Patch Version 1.22.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-47254?
CVE-2026-47254 has a medium severity rating of 6.1.
How do I fix CVE-2026-47254?
To fix CVE-2026-47254, upgrade to libheif version 1.22.0 or later.
What is the impact of CVE-2026-47254?
CVE-2026-47254 can lead to a heap buffer overflow due to out-of-bounds chunk vector access.
Is CVE-2026-47254 exploitable remotely?
Yes, CVE-2026-47254 is potentially exploitable remotely as it involves user inputs.
Which software is affected by CVE-2026-47254?
CVE-2026-47254 affects debian/libheif and the struktur Libheif software.