strukturag libheif up to 1.21.2 Inline Mask Parsing libheif/region.cc width/height integer overflow

Summaryinfo

A vulnerability labeled as critical has been found in strukturag libheif up to 1.21.2. The affected element is an unknown function of the file libheif/region.cc of the component Inline Mask Parsing. The manipulation of the argument width/height results in integer overflow. This vulnerability is known as CVE-2026-47714. It is possible to launch the attack remotely. No exploit is available.

Detailsinfo

A vulnerability, which was classified as critical, was found in strukturag libheif up to 1.21.2. Affected is an unknown part of the file libheif/region.cc of the component Inline Mask Parsing. The manipulation of the argument width/height with an unknown input leads to a integer overflow vulnerability. CWE is classifying the issue as CWE-190. The product performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, the inline mask parsing code in `libheif/region.cc` contains an integer overflow. Both `width` and `height` are `unsigned int` (32-bit) values parsed from the HEIF file. Their product can exceed `UINT32_MAX`, wrapping to a small value before the division by 8. This causes an undersized buffer allocation, leading to out-of-bounds memory access when the mask data is later interpreted as a `width x height` bitmap. Version 1.22.0 patches the issue.

The advisory is available at github.com. This vulnerability is traded as CVE-2026-47714 since 05/19/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Technical details are known, but there is no available exploit.

Upgrading to version 1.22.0 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• strukturag

Name

• libheif

Version

• 1.21.0
• 1.21.1
• 1.21.2

Website

• Product: https://github.com/strukturag/libheif/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion