CVE-2026-47178

libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.19.0 through 1.21.2, a crafted HEIF file (uncompressed unci codec, tiled, component-interleaved, 4:2:0) triggers a heap out-of-bounds write in libheif's uncompressed tile decoder. The write overwrites the C++ vtable pointer of an adjacent unc_decoder_component_interleave object; the next virtual call dispatches to an attacker-chosen address. Version 1.22.0 patches the issue.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47178.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-787"
    ]
}

References

Affected packages

Git / github.com/strukturag/libheif

Affected ranges

Type

GIT

Repo

https://github.com/strukturag/libheif

Events

Introduced

c4e4657dcf6bcc06e934632f97736f7c78dbff9e

Fixed

0c81a846b7401dbdb7118afd0761057f21e43511

Database specific

{
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ],
    "extracted_events": [
        {
            "introduced": "1.19.0"
        },
        {
            "fixed": "1.22.0"
        },
        {
            "fixed": "1.21.2"
        }
    ]
}

Affected versions

v1.*

v1.19.0

v1.19.1

v1.19.2

v1.19.3

v1.19.4

v1.19.5

v1.20.0

v1.20.1

v1.21.0

v1.21.1

v1.21.2

Database specific

vanir_signatures

[
    {
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "175107675317900759648359576881034358256",
                "220432159010798240840908416937024023837",
                "268268967745545109707798594937166387611",
                "253707932335489477155115861206639265538",
                "199679408075604976163979654915891773303",
                "175107675317900759648359576881034358256",
                "220432159010798240840908416937024023837",
                "268268967745545109707798594937166387611",
                "286778284410146987248233194002847271266",
                "178248309108630471590778685235254536836"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/strukturag/libheif/commit/0c81a846b7401dbdb7118afd0761057f21e43511",
        "signature_type": "Line",
        "target": {
            "file": "tests/uncompressed_box.cc"
        },
        "id": "CVE-2026-47178-91619f1d",
        "deprecated": false
    }
]

vanir_signatures_modified

"2026-07-23T08:25:15Z"

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47178.json"