Vulnerability Description
libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, two bugs in libheif chain to leak process heap memory as visible pixel values in decoded grid images. An attacker who uploads a crafted AVIF/HEIC file to any server-side image processor (WordPress, Sharp/libvips, ImageMagick, etc.) can recover heap data - including library function pointers sufficient to defeat ASLR, or any other secret - from the publicly-downloadable transcoded JPEG/PNG/WebP output. Local attack vectors are also possible. Version 1.22.0 fixes the issue.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Struktur | Libheif | < 1.22.0 |
Related Weaknesses (CWE)
References
- https://github.com/strukturag/libheif/security/advisories/GHSA-2vh6-whr3-cmq3ExploitVendor AdvisoryMitigation
- https://github.com/strukturag/libheif/security/advisories/GHSA-2vh6-whr3-cmq3ExploitVendor AdvisoryMitigation
FAQ
What is CVE-2026-47247?
CVE-2026-47247 is a vulnerability with a CVSS score of 7.5 (HIGH). libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, two bugs in libheif chain to leak process heap memory as visible pixel values in decoded grid images. An attacker w...
How severe is CVE-2026-47247?
CVE-2026-47247 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-47247?
Check the references section above for vendor advisories and patch information. Affected products include: Struktur Libheif.