# CVE-2026-49271: libheif out-of-bounds read in uncompressed HEIF decoder

Source: https://junglewise.ai/threats/cve-2026-49271-libheif-out-of-bounds-read-in-uncompressed-heif-decoder  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-19. Updated: 2026-06-21  
License: CC BY 4.0 with a link back

CVE-2026-49271 · Severity: medium · CVSS 6.5 · Published 2026-06-19

libheif is a software library used by many applications to process HEIF and AVIF image files. A vulnerability in how it handles uncompressed images allows a specially crafted file to cause the application to crash. This could lead to a denial-of-service, preventing users from viewing images or causing software that processes these files to fail.

## Quick answers

**Is CVE-2026-49271 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-49271 being exploited in the wild.

**How severe is CVE-2026-49271?** Medium severity, with a CVSS score of 6.5, published 19 June 2026.

**Which products and versions are affected?** strukturag libheif < 1.22.1.

**Is there a fix for CVE-2026-49271?** A patch was published on 2026-06-19: Version 1.22.1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-49271 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-49271?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An out-of-bounds read vulnerability exists in libheif's uncompressed HEIF decoder (unc_decoder.cc) due to an integer overflow in a range check. The function unc_decoder::get_compressed_image_data_uncompressed validates 'icef' compressed-unit offsets using the addition 'unit_offset + unit_size'. An attacker can provide a crafted HEIF file with values that wrap around, bypassing the check and allowing the construction of iterators outside the compressed item buffer. This results in a heap-based out-of-bounds read and a process crash. The vulnerability is reachable when the 'cmpC' compressed unit type is not 'image_tile' and requires the user to open a malicious file. The issue is fixed in version 1.22.1 by implementing proper subtraction-based bounds checking.

## Affected products

- strukturag libheif < 1.22.1

## Timeline

- 2026-05-25: advisory: GitHub Security Advisory published
- 2026-06-19: disclosed: CVE published to NVD
- 2026-06-19: patched: Version 1.22.1 released

## References

- [https://github.com/strukturag/libheif/security/advisories/GHSA-r7qj-cg5r-r6vf](https://github.com/strukturag/libheif/security/advisories/GHSA-r7qj-cg5r-r6vf)