CVE-2026-47709

UNKNOWN 0.0

libheif has a NULL pointer dereference in heif_image_handle_get_image_tiling for malformed unci image missing ispe

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

libheif is a HEIF and AVIF file format decoder and encoder. Versions prior to 1.22.0 crashes in the public C API `heif_image_handle_get_image_tiling()` when a malformed uncompressed HEIF image item has an associated `uncC` property but no associated `ispe` property. In debug builds this trips the `ispe && uncC` assertion in `ImageItem_uncompressed::get_heif_image_tiling()`. In a release/NDEBUG ASan build, the same file causes a null pointer read at address `0xa8`. Version 1.22.0 fixes the issue.

CWE	CWE-476
Vendor	strukturag
Product	libheif
Published	Jul 21, 2026

Stay Ahead of the Next One

Get instant alerts for strukturag libheif

Be the first to know when new unknown vulnerabilities affecting strukturag libheif are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

strukturag / libheif

< 1.22.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/strukturag/libheif/security/advisories/GHSA-4h72-vqgp-9376 github.com: https://github.com/strukturag/libheif/issues/1802 github.com: https://github.com/strukturag/libheif/pull/1806