CVE-2026-47709: libheif has a NULL pointer dereference in heif_image_handle_get_image_tiling for malformed unci image missing ispe
Last updated 10 July 2026
Other sources
libheif is a HEIF and AVIF file format decoder and encoder. Versions prior to 1.22.0 crashes in the public C API heifimagehandlegetimagetiling() when a malformed uncompressed HEIF image item has an associated uncC property but no associated ispe property. In debug builds this trips the ispe && uncC assertion in ImageItemuncompressed::getheifimagetiling(). In a release/NDEBUG ASan build, the same file causes a null pointer read at address 0xa8. Version 1.22.0 fixes the issue.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-47709?
CVE-2026-47709 has a medium severity rating of 6.9 according to the CVSS scoring system.
How do I fix CVE-2026-47709?
To fix CVE-2026-47709, update libheif to version 1.22.0 or later, where the vulnerability has been addressed.
What causes the vulnerability CVE-2026-47709?
CVE-2026-47709 is caused by a NULL pointer dereference in the `heif_image_handle_get_image_tiling()` function when processing malformed HEIF images.
Which versions of libheif are affected by CVE-2026-47709?
All versions of libheif prior to 1.22.0 are affected by CVE-2026-47709.
What impact does CVE-2026-47709 have on applications using libheif?
CVE-2026-47709 can cause applications using libheif to crash when encountering malformed uncompressed HEIF images.