CVE-2026-47178 in libheif
Summary
by MITRE • 07/22/2026
libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.19.0 through 1.21.2, a crafted HEIF file (uncompressed `unci` codec, tiled, component-interleaved, 4:2:0) triggers a heap out-of-bounds write in libheif's uncompressed tile decoder. The write overwrites the C++ vtable pointer of an adjacent `unc_decoder_component_interleave` object; the next virtual call dispatches to an attacker-chosen address. Version 1.22.0 patches the issue.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
The vulnerability in libheif represents a critical heap-based buffer overflow that can be exploited through maliciously crafted HEIF files, specifically targeting uncompressed `unci` codec structures with tiled organization and component-interleaved 4:2:0 chroma sampling. This flaw exists within the library's uncompressed tile decoder implementation and demonstrates a classic out-of-bounds write condition where attacker-controlled data overflows into adjacent memory regions. The vulnerability affects versions ranging from 1.19.0 through 1.21.2, making it a persistent issue across multiple releases that required a dedicated patch in version 1.22.0 to address the underlying memory corruption mechanism.
The technical execution of this vulnerability involves a precise memory layout manipulation where the heap overflow directly targets and overwrites the C++ virtual table pointer of an adjacent object instance. This particular memory layout allows the attacker to control the vtable pointer of the `unc_decoder_component_interleave` object, which fundamentally alters the program's execution flow during subsequent virtual method calls. The overwrite occurs because the decoder fails to properly validate the bounds of data structures before performing memory operations, particularly when processing tiled image components with specific chroma sampling characteristics that trigger the vulnerable code path.
The operational impact of this vulnerability extends beyond simple memory corruption, as it provides a direct pathway for remote code execution through controlled vtable pointer manipulation. When the next virtual call is dispatched to the modified object, the program jumps to an attacker-controlled memory address rather than the legitimate function implementation, enabling arbitrary code execution within the context of the vulnerable application. This type of vulnerability falls under CWE-787: "Out-of-bounds Write" and aligns with ATT&CK technique T1059.007 for command and scripting interpreter, as successful exploitation could allow attackers to execute malicious payloads through compromised applications that utilize libheif for image processing.
The exploitation requires careful crafting of HEIF files with specific structural characteristics including uncompressed `unci` codec usage, tiled data organization, and component-interleaved 4:2:0 chroma subsampling. This particular combination creates the precise memory layout necessary to achieve the heap overflow condition that overwrites the vtable pointer. The vulnerability demonstrates poor input validation practices in the decoder's memory management logic and highlights the importance of bounds checking for all data structures, particularly those handling image format decompression where attackers can control the input data structure sizes and layouts. Organizations using libheif in their applications should immediately upgrade to version 1.22.0 or later to mitigate this risk, as the patch addresses the fundamental memory corruption issue within the uncompressed tile decoding routine.