CVE-2026-47254 strukturag CVE debrief

Who should care

Users of libheif, a HEIF and AVIF file format decoder and encoder, should review and apply the patch to prevent exploitation of this MEDIUM severity vulnerability. Affected operators should assess their exposure and prioritize remediation efforts. Platform administrators should ensure that libheif is updated to version 1.22.0 or later. Vulnerability management teams should track exceptions and retest remediated assets. Security teams should review compensating controls for exposed systems while remediation is scheduled and verified.

Technical summary

Prior to version 1.22.0, `Track::init_sample_timing_table()` in `libheif/sequences/track.cc` stores an out-of-bounds chunk index (`m_chunks.size()`) into `m_presentation_timeline` when the number of chunks defined in the `stco` box is less than the number of samples in `stsz`. A subsequent call to `heif_track_get_next_raw_sequence_sample()` reads `m_chunks[chunk_idx]` with that OOB index, causing a heap-buffer-overflow.

Defensive priority

Apply the patch to prevent exploitation of this MEDIUM severity vulnerability. Monitor for and respond to potential exploitation attempts. Review and update libheif to ensure version 1.22.0 or later is in use. Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Check relevant monitoring, detection, and logs for exposed assets that need extra review. Track exceptions, retest remediated assets, and close the item only after evidence is documented. Review compensating controls for exposed systems while remediation is scheduled and verified. Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Consider an asset inventory to identify potentially affected systems. Consider source tracking for changes related to this vulnerability. Consider monitoring for indicators of compromise related to this vulnerability. Consider compensating controls such as network segmentation or additional security measures for exposed systems. Consider rollback or change windows for remediation efforts. Consider exposure review to identify potential vulnerabilities and prioritize remediation efforts.

Recommended defensive actions

• Apply the patch to upgrade libheif to version 1.22.0 or later.
• Review and update libheif to ensure version 1.22.0 or later is in use.
• Monitor for and respond to potential exploitation attempts.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. The CVE record was published on 2026-07-21T22:17:12.957Z and has not been modified since then. The NVD entry is currently awaiting analysis. There are limited details available on the vulnerability, and defenders should verify the affected scope and severity with the vendor. The vulnerability causes a heap-buffer-overflow in libheif, a HEIF and AVIF file format decoder and encoder. Users should review the official advisory and CVE record for more information.

Official resources