CVE-2026-47714 in libheif
Summary
by MITRE • 07/22/2026
libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, the inline mask parsing code in `libheif/region.cc` contains an integer overflow. Both `width` and `height` are `unsigned int` (32-bit) values parsed from the HEIF file. Their product can exceed `UINT32_MAX`, wrapping to a small value before the division by 8. This causes an undersized buffer allocation, leading to out-of-bounds memory access when the mask data is later interpreted as a `width x height` bitmap. Version 1.22.0 patches the issue.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/22/2026
The libheif library represents a critical vulnerability in its handling of HEIF and AVIF file format processing through an integer overflow condition present in the inline mask parsing functionality. This flaw exists within the region.cc source file where unsigned 32-bit integers are used to store width and height dimensions parsed from HEIF files. The vulnerability stems from the mathematical operation involving these dimensions that can result in arithmetic overflow when computing buffer sizes for mask data processing. When the product of width and height exceeds the maximum value representable by a 32-bit unsigned integer, the computation wraps around to produce an unexpectedly small value before subsequent division by eight occurs.
The operational impact of this vulnerability manifests as insufficient buffer allocation during memory management operations within the file parsing pipeline. This undersized allocation creates a scenario where memory access patterns extend beyond allocated boundaries, enabling potential out-of-bounds memory access conditions that could be exploited by malicious actors. The flaw particularly affects the interpretation of mask data as bitmap structures, where the actual dimensions specified in the HEIF file do not align with the buffer size allocated by the vulnerable code path. Attackers could potentially craft specially formatted HEIF files that trigger this overflow condition, leading to memory corruption that might result in arbitrary code execution or application crashes.
This vulnerability maps directly to CWE-190, which classifies integer overflow and wraparound conditions, and aligns with ATT&CK technique T1203, focusing on Exploitation for Client Execution through malformed file processing. The issue demonstrates poor input validation practices in the parsing of structured multimedia data formats, where dimensional parameters from external sources are not properly constrained against arithmetic limits. The fix implemented in version 1.22.0 addresses this by introducing proper bounds checking and overflow detection mechanisms before buffer allocation occurs. Organizations using libheif should prioritize immediate upgrade to version 1.22.0 or later to mitigate potential exploitation risks, while also implementing defensive measures such as input sanitization and memory access monitoring during file processing operations. The vulnerability highlights the importance of robust integer arithmetic handling in multimedia libraries where external data inputs can be manipulated to cause memory safety issues through mathematical overflow conditions.