CVE-2026-47247 strukturag CVE debrief

Who should care

Users of libheif, particularly those who process HEIF and AVIF files, should be aware of this vulnerability and take steps to mitigate it. Affected operators, platforms, and security teams should review the vulnerability and implement necessary controls.

Technical summary

Prior to version 1.22.0, two bugs in libheif chain to leak process heap memory as visible pixel values in decoded grid images. An attacker who uploads a crafted AVIF/HEIC file to any server-side image processor can recover heap data, including library function pointers sufficient to defeat ASLR, or any other secret, from the publicly-downloadable transcoded JPEG/PNG/WebP output. Local attack vectors are also possible.

Defensive priority

High

Recommended defensive actions

• Update libheif to version 1.22.0 or later
• Validate and sanitize input files
• Implement memory protection mechanisms
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions and retest remediated assets
• Perform exposure review and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-07-21T22:17:12.643Z and has been modified since then. The NVD entry is currently being processed. The vulnerability affects libheif, a HEIF and AVIF file format decoder and encoder. Limited source detail is available, and defenders should verify the affected scope and severity. Evidence limits suggest that an attacker can recover heap data, including library function pointers, from publicly-downloadable transcoded images.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.