strukturag libheif up to 1.21.x Sample Timing Table track.cc init_sample_timing_table out-of-bounds

Summaryinfo

A vulnerability categorized as critical has been discovered in strukturag libheif up to 1.21.x. Impacted is the function Track::init_sample_timing_table of the file libheif/sequences/track.cc of the component Sample Timing Table. Executing a manipulation can lead to out-of-bounds. This vulnerability appears as CVE-2026-47254. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability has been found in strukturag libheif up to 1.21.x and classified as critical. This vulnerability affects the function Track::init_sample_timing_table of the file libheif/sequences/track.cc of the component Sample Timing Table. The manipulation with an unknown input leads to a out-of-bounds vulnerability. The CWE definition for the vulnerability is CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, `Track::init_sample_timing_table()` in `libheif/sequences/track.cc` stores an out-of-bounds chunk index (`m_chunks.size()`) into `m_presentation_timeline` when the number of chunks defined in the `stco` box is less than the number of samples in `stsz`. A subsequent call to `heif_track_get_next_raw_sequence_sample()` reads `m_chunks[chunk_idx]` with that OOB index, causing a heap-buffer-overflow. Version 1.22.0 fixes the issue.

The advisory is available at github.com. This vulnerability was named CVE-2026-47254 since 05/19/2026. The exploitation appears to be easy. The attack can be initiated remotely. Technical details are known, but there is no available exploit.

Upgrading to version 1.22.0 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• strukturag

Name

• libheif

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14
• 1.15
• 1.16
• 1.17
• 1.18
• 1.19
• 1.20
• 1.21

Website

• Product: https://github.com/strukturag/libheif/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion