Is CVE-2026-47247 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-47247 being exploited in the wild.

How severe is CVE-2026-47247?

High severity, with a CVSS score of 7.5, published 21 July 2026.

Is there a fix for CVE-2026-47247?

A patch was published on 2026-07-21: Fix confirmed in version 1.22.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-47247 attacked?

It is attacked over the network or with local access, in a software library.

Am I affected by CVE-2026-47247?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-47247: Strukturag libheif heap information disclosure in grid image decoding

CVE-2026-47247 · Severity: high · CVSS 7.5 · Published 2026-07-21

libheif is a widely used software library for processing HEIF and AVIF images, commonly utilized by web platforms like WordPress and image processing tools like ImageMagick. A vulnerability in how the library handles image grids allows an attacker to upload a specially crafted image file that, when processed by a server, leaks sensitive information from the server's memory. This leaked data can include secret keys or internal memory addresses used to bypass security protections, potentially facilitating more advanced attacks against the hosting infrastructure.

Quick answers

Is CVE-2026-47247 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-47247 being exploited in the wild.
How severe is CVE-2026-47247?: High severity, with a CVSS score of 7.5, published 21 July 2026.
Which products and versions are affected?: strukturag libheif < 1.22.0.
Is there a fix for CVE-2026-47247?: A patch was published on 2026-07-21: Fix confirmed in version 1.22.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-47247 attacked?: It is attacked over the network or with local access, in a software library.
Am I affected by CVE-2026-47247?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap information disclosure vulnerability exists in libheif due to the chaining of two flaws: uninitialized pixel plane allocation and an incorrect grid coverage check. The first flaw (CWE-908) occurs in `pixelimage.cc` where memory is allocated without zero-initialization, leaving stale heap data in padding and gap regions. The second flaw (CWE-682) in `grid.cc` uses integer division to validate tile sizes, allowing a 'gap' of unwritten pixels if the tiles do not perfectly divide the grid dimensions. An attacker can craft an AVIF/HEIC file where these gap pixels represent raw heap bytes, which are then rendered into the output image (e.g., JPEG/PNG). This allows for the extraction of sensitive data, such as function pointers to defeat ASLR, via remote network vectors (e.g., uploading to a web server) or local vectors. The issue is fixed in version 1.22.0 by zero-initializing allocations and correcting the grid coverage logic.

Affected products

strukturag libheif < 1.22.0

Timeline

2026-05-19: advisory: GitHub Security Advisory published
2026-07-21: disclosed: CVE published to NVD
2026-07-21: patched: Fix confirmed in version 1.22.0

References

https://github.com/strukturag/libheif/security/advisories/GHSA-2vh6-whr3-cmq3

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.