Executive brief
libheif is a software library used by many applications to process HEIF and AVIF image files. A flaw in how the library handles certain video tracks (VVC) allows a specially crafted image file to crash the application or potentially expose small amounts of memory. This vulnerability is particularly notable because it exists within a security check that was intended to fix a previous bug, but was itself implemented incorrectly.
Technical details
An integer overflow exists in the `vvdec_push_data2` function within `libheif/plugins/decoder_vvdec.cc`. The vulnerability occurs because the security check `if (frame_size < 4 + size)` uses 32-bit unsigned integer arithmetic; when `size` is near UINT32_MAX, the addition wraps around, bypassing the bounds check. An attacker can provide a crafted HEIF file with a VVC track containing a large size prefix to trigger an out-of-bounds heap read during a subsequent `std::vector::insert` operation. This can result in a denial-of-service (crash) or limited information disclosure. The issue was introduced as an incomplete fix for CVE-2026-3949 and is resolved in version 1.22.0.
Affected products
- strukturag libheif <= 1.21.2
Timeline
- 2026-02-23: other: Vulnerability introduced in commit b97c8b5
- 2026-05-19: advisory: GitHub Security Advisory published
- 2026-07-21: disclosed: CVE-2026-47251 published to NVD
- 2026-07-21: patched: Version 1.22.0 released