CVE-2026-47254 in libheif
Summary
by MITRE • 07/22/2026
libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, `Track::init_sample_timing_table()` in `libheif/sequences/track.cc` stores an out-of-bounds chunk index (`m_chunks.size()`) into `m_presentation_timeline` when the number of chunks defined in the `stco` box is less than the number of samples in `stsz`. A subsequent call to `heif_track_get_next_raw_sequence_sample()` reads `m_chunks[chunk_idx]` with that OOB index, causing a heap-buffer-overflow. Version 1.22.0 fixes the issue.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
The vulnerability exists within libheif version 1.22.0 and earlier, specifically in the Track::init_sample_timing_table() function located in libheif/sequences/track.cc. This flaw stems from improper bounds checking during the initialization of sample timing tables for HEIF and AVIF file processing. The issue manifests when the stco box contains fewer chunk entries than the number of samples defined in the stsz box, creating a scenario where an out-of-bounds chunk index is stored in m_presentation_timeline. This condition violates fundamental memory safety principles and represents a classic buffer overflow vulnerability that can be categorized under CWE-129 as "Improper Validation of Array Index" and CWE-787 as "Out-of-bounds Write." The flaw directly impacts the file format parsing logic where the library attempts to map samples to their corresponding chunks without proper validation of chunk boundaries.
The operational impact of this heap-buffer-overflow vulnerability is significant for any system utilizing libheif for image processing, particularly in environments where untrusted HEIF or AVIF files are processed. When heif_track_get_next_raw_sequence_sample() is subsequently called, the library attempts to access m_chunks[chunk_idx] using the invalid out-of-bounds index that was previously stored. This results in memory corruption that can potentially lead to arbitrary code execution, denial of service, or information disclosure depending on the specific memory layout and exploitation circumstances. The vulnerability represents a critical security risk within the software supply chain since libheif is widely used in various applications including web browsers, mobile operating systems, and image processing frameworks.
The fix implemented in version 1.22.0 addresses this issue by enforcing proper bounds checking during the sample timing table initialization process. This mitigation ensures that chunk indices stored in m_presentation_timeline remain within valid array boundaries, preventing the out-of-bounds memory access that previously occurred. From an ATT&CK perspective, this vulnerability could be leveraged as part of a broader attack chain targeting media processing libraries, potentially falling under techniques such as T1203 "Exploitation for Client Execution" and T1595 "Active Scanning." The remediation aligns with security best practices for memory safety and input validation, demonstrating the importance of proper bounds checking in multimedia format parsers where malformed files can be used as attack vectors. Organizations using libheif should prioritize upgrading to version 1.22.0 or later to mitigate this heap-buffer-overflow vulnerability that could otherwise enable attackers to compromise systems through maliciously crafted HEIF or AVIF image files.