CVE-2026-48029

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-48029
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-48029.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-48029
Aliases
  • GHSA-6x5f-qchq-cxqv
Downstream
Related
Published
2026-07-22T14:13:27Z
Modified
2026-08-12T16:09:40Z
Severity
  • 7.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H CVSS Calculator
Summary
libheif: heap OOB read in ImageItem_Grid::decode_grid_tile via irot-induced tile-coordinate underflow
Details

libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.19.0 through 1.21.2 have a heap OOB read in ImageItem_Grid::decode_grid_tile via irot-induced tile-coordinate underflow. Version 1.22.0 fixes the issue.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-125",
        "CWE-191"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48029.json"
}
References

Affected packages

Git / github.com/strukturag/libheif

Affected ranges

Type
GIT
Repo
https://github.com/strukturag/libheif
Events
Introduced
c4e4657dcf6bcc06e934632f97736f7c78dbff9e
Fixed
0c81a846b7401dbdb7118afd0761057f21e43511
Fixed
e523ec0bf379110b7c33d4c159f8b1202d332157
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:struktur:libheif:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "1.19.0"
        },
        {
            "fixed": "1.22.0"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

v1.*
v1.19.0
v1.19.1
v1.19.2
v1.19.3
v1.19.4
v1.19.5
v1.20.0
v1.20.1
v1.21.0
v1.21.1
v1.21.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-48029.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "219672841497125228837406579397721311186",
                "315779767215743454278419725292135505629",
                "215835686115960783367434370615845683380",
                "220195703957652418608139017556705508485",
                "284684120236742493951222199338408499535",
                "291911574542756313538833287141925065596",
                "133957057838998640717971264815759942744",
                "158249638131538298481729105262811394233",
                "160379433229875705621296413893020127366",
                "329569414691431598912517690362946350890",
                "73155902000559147788854875555204618317"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-48029-6179d178",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/strukturag/libheif/commit/e523ec0bf379110b7c33d4c159f8b1202d332157",
        "target": {
            "file": "tests/grid_tile_missing.cc"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "175107675317900759648359576881034358256",
                "220432159010798240840908416937024023837",
                "268268967745545109707798594937166387611",
                "253707932335489477155115861206639265538",
                "199679408075604976163979654915891773303",
                "175107675317900759648359576881034358256",
                "220432159010798240840908416937024023837",
                "268268967745545109707798594937166387611",
                "286778284410146987248233194002847271266",
                "178248309108630471590778685235254536836"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-48029-91619f1d",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/strukturag/libheif/commit/0c81a846b7401dbdb7118afd0761057f21e43511",
        "target": {
            "file": "tests/uncompressed_box.cc"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "101919996153013846005192198994109606177",
            "length": 1278
        },
        "id": "CVE-2026-48029-ace1db76",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/strukturag/libheif/commit/e523ec0bf379110b7c33d4c159f8b1202d332157",
        "target": {
            "file": "libheif/image-items/image_item.cc",
            "function": "ImageItem::transform_requested_tile_position_to_original_tile_position"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "210117582881865826027694516329891578567",
                "310864928099286494627115651940640439123",
                "214711710888286477857043561187576557234",
                "231462530368041100495367541668300113017",
                "303020485749098350307795373176467076626",
                "328099988574941819655366579322791715068",
                "225017007332046956572453292407532612614",
                "68674642594692389567704831319552718049",
                "303971659695796642572985008411981253680",
                "41371416608160114851679536515213197864",
                "208032861094950670939479404550127845063",
                "49515022252517102417074625220623554131",
                "28286795811453010450669689977410935712",
                "266223978065385515281774005924802299117",
                "175934310551840688475386156401427485789",
                "29117612320120474489142139412262744667",
                "5306951783107611777627684941394785901",
                "208032861094950670939479404550127845063",
                "261706219315416336770573550838040632491",
                "289684133007866095107926125875164088483",
                "323407937391011148087911232621786152854",
                "307008051018095746719216087304102477491",
                "82053225423708514858267130413144370990",
                "314662921962429445904903299064041341331",
                "301162486735782784892137528069119439043",
                "284114789844196746649792317052669140320",
                "280250846371260273203496000182600501637",
                "222621235650153467546053501785910134104",
                "290175884920585446034084865117122461156",
                "28461869088389044711965001472443274683",
                "114663818581261751624540330828840247321"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-48029-c40a27ea",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/strukturag/libheif/commit/e523ec0bf379110b7c33d4c159f8b1202d332157",
        "target": {
            "file": "libheif/image-items/image_item.cc"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "303576816191694175519857374120379964321",
            "length": 784
        },
        "id": "CVE-2026-48029-e798614f",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/strukturag/libheif/commit/e523ec0bf379110b7c33d4c159f8b1202d332157",
        "target": {
            "file": "libheif/api/libheif/heif_tiling.cc",
            "function": "heif_image_handle_get_grid_image_tile_id"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "113498616673066899531144533690175326093",
                "136096610111804126362088435630880183094",
                "159970502301300374236780206658760908393",
                "292630673733568239895385567875481479037",
                "41108650999419596544495125452023607014",
                "136153729725945887494790318795966255520",
                "135416419551574966981220639972932603586",
                "73831006951657426912819336044944903913",
                "195170187878487489337472969035943944430",
                "243045804143113856207189529235864314925"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-48029-ed3117de",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/strukturag/libheif/commit/e523ec0bf379110b7c33d4c159f8b1202d332157",
        "target": {
            "file": "libheif/api/libheif/heif_tiling.cc"
        }
    }
]
vanir_signatures_modified 
"2026-08-12T16:09:40Z"