Is CVE-2026-48029 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-48029 being exploited in the wild.

How severe is CVE-2026-48029?

High severity, with a CVSS score of 7.1, published 22 July 2026.

Which products and versions are affected?

struktur AG Libheif 1.19.0 - 1.21.2.

Is there a fix for CVE-2026-48029?

A patch was published on 2026-05-18: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-48029 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-48029?

Check whether you run struktur AG Libheif at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48029: Strukturag libheif heap OOB read in ImageItem_Grid::decode_grid_tile

CVE-2026-48029 · Severity: high · CVSS 7.1 · Published 2026-07-22

libheif is a widely used software library for decoding and encoding HEIF and AVIF image files. A vulnerability in how the library handles rotated images allows an attacker to crash applications that process these images or potentially access sensitive information from the computer's memory. This could lead to service outages or data exposure if a user is tricked into opening a specially crafted image file.

Technologies: struktur AG Libheif. Vendors: struktur AG.

Quick answers

Is CVE-2026-48029 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-48029 being exploited in the wild.
How severe is CVE-2026-48029?: High severity, with a CVSS score of 7.1, published 22 July 2026.
Which products and versions are affected?: struktur AG Libheif 1.19.0 - 1.21.2.
Is there a fix for CVE-2026-48029?: A patch was published on 2026-05-18: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48029 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-48029?: Check whether you run struktur AG Libheif at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap out-of-bounds (OOB) read exists in libheif's ImageItem_Grid::decode_grid_tile function. The vulnerability is caused by an integer underflow in ImageItem::transform_requested_tile_position_to_original_tile_position when processing 'irot' (rotation) properties (90, 180, or 270 degrees) where rows and columns are unequal. The library fails to validate caller-supplied tile coordinates against post-rotation bounds before performing subtraction, resulting in a massive unsigned integer value. This value is subsequently used as an index for m_grid_tile_ids without bounds checking in release builds, leading to a SIGSEGV or OOB read. The issue is fixed in version 1.22.0.

Affected products

strukturag libheif 1.19.0 - 1.21.2

Timeline

2026-05-18: patched: Fix committed to repository
2026-05-20: disclosed: Security advisory published on GitHub
2026-07-22: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.