Is CVE-2026-47254 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-47254 being exploited in the wild.

How severe is CVE-2026-47254?

Medium severity, with a CVSS score of 6.1, published 21 July 2026.

Is there a fix for CVE-2026-47254?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-47254 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-47254?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-47254: Strukturag libheif heap buffer overflow in Track sequence handling

CVE-2026-47254 · Severity: medium · CVSS 6.1 · Published 2026-07-21

libheif is an open-source library used to decode and encode HEIF and AVIF image files, commonly used in photo viewing and editing software. A vulnerability in how the library handles malformed image sequences could allow an attacker to crash an application or potentially access sensitive information from the computer's memory. To exploit this, an attacker would need to trick a user into opening a specially crafted image file.

Quick answers

Is CVE-2026-47254 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-47254 being exploited in the wild.
How severe is CVE-2026-47254?: Medium severity, with a CVSS score of 6.1, published 21 July 2026.
Which products and versions are affected?: strukturag libheif < 1.22.0.
Is there a fix for CVE-2026-47254?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-47254 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-47254?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An out-of-bounds (OOB) read vulnerability exists in libheif's `Track::init_sample_timing_table()` within `libheif/sequences/track.cc`. The flaw occurs when the number of chunks defined in the `stco` (Sample Table Chunk Offset) box is less than the number of samples in the `stsz` (Sample Size) box, causing an OOB chunk index to be stored in `m_presentation_timeline`. A subsequent call to `heif_track_get_next_raw_sequence_sample()` triggers a heap-buffer-overflow when reading from the `m_chunks` vector using the invalid index. This requires a user to open a maliciously crafted HEIC/AVIF file. The issue is resolved in version 1.22.0 by improving validation of sample-to-chunk mappings.

Affected products

strukturag libheif < 1.22.0

Timeline

2026-05-19: advisory: GitHub Security Advisory published
2026-07-21: disclosed: CVE published to NVD

References

https://github.com/strukturag/libheif/security/advisories/GHSA-wqjg-4x9g-6cvg

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.