Is CVE-2026-47709 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-47709 being exploited in the wild.

How severe is CVE-2026-47709?

Informational severity, with a CVSS score of 6.9, published 21 July 2026.

Is there a fix for CVE-2026-47709?

A patch was published on 2026-07-21: Version 1.22.0 released and CVE published Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-47709 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-47709?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-47709: Strukturag libheif NULL pointer dereference in heif_image_handle_get_image_tiling

CVE-2026-47709 · Severity: info · CVSS 6.9 · Published 2026-07-21

libheif, a library used for decoding and encoding HEIF and AVIF image files, is vulnerable to a crash when processing specially crafted image files. An attacker could provide a malformed image that, when opened by an application using this library, causes the application to shut down unexpectedly. This results in a denial-of-service, affecting the availability of image viewing or processing services.

Quick answers

Is CVE-2026-47709 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-47709 being exploited in the wild.
How severe is CVE-2026-47709?: Informational severity, with a CVSS score of 6.9, published 21 July 2026.
Which products and versions are affected?: strukturag libheif < 1.22.0.
Is there a fix for CVE-2026-47709?: A patch was published on 2026-07-21: Version 1.22.0 released and CVE published Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-47709 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-47709?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A NULL pointer dereference exists in libheif versions prior to 1.22.0 within the `heif_image_handle_get_image_tiling()` C API. The vulnerability occurs when a malformed uncompressed HEIF image item contains an associated `uncC` (uncompressed configuration) property but lacks the required `ispe` (image spatial extents) property. In `ImageItem_uncompressed::get_heif_image_tiling()`, the code assumes both properties are present; in release builds where assertions are disabled, the missing `ispe` property results in a NULL pointer dereference at offset `0xa8`. An attacker can trigger this by providing a crafted HEIF file to any application utilizing the library's tiling API, resulting in a process crash. The issue is fixed in version 1.22.0.

Affected products

strukturag libheif < 1.22.0

Timeline

2026-05-18: disclosed: Initial issue reported on GitHub
2026-05-19: advisory: GitHub Security Advisory published
2026-07-21: patched: Version 1.22.0 released and CVE published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.