SB2026072474 - Ubuntu update for libheif
Published: July 24, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 5 vulnerabilities.
1) Out-of-bounds read (CVE-ID: CVE-2026-47254)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to cause a denial of service or disclose sensitive information.
The vulnerability exists due to out-of-bounds read in Track::get_next_sample_raw_data() when parsing a crafted HEIC sequence file and retrieving raw sequence samples. A remote attacker can supply a specially crafted file to cause a denial of service or disclose sensitive information.
The issue is triggered when the number of chunks defined in the stco box is less than the number of samples in stsz, causing an invalid chunk index to be stored in the presentation timeline.
2) NULL pointer dereference (CVE-ID: CVE-2026-47709)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a null pointer dereference in heif_image_handle_get_image_tiling() when processing a malformed uncompressed HEIF image item missing the ispe property. A remote attacker can supply a specially crafted HEIF file to cause a denial of service.
The issue is reachable through the public C API and may trigger an assertion in debug builds.
3) Integer overflow (CVE-ID: CVE-2026-47714)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to cause a denial of service and disclose sensitive information.
The vulnerability exists due to integer overflow or wraparound in the inline mask parsing code in libheif/region.cc when parsing a crafted HEIF file. A remote attacker can trick the victim into opening a crafted file to cause a denial of service and disclose sensitive information.
The issue is reachable when applications raise the max_image_size_pixels limit or disable it via LIBHEIF_SECURITY_LIMITS=off.
4) Out-of-bounds read (CVE-ID: CVE-2026-48029)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to cause a denial of service and disclose sensitive information.
The vulnerability exists due to out-of-bounds read in ImageItem_Grid::decode_grid_tile when parsing a crafted HEIF/HEIC file containing a grid-derived item with an irot rotation property. A remote attacker can send a specially crafted file to cause a denial of service and disclose sensitive information.
User interaction is required to open or decode the crafted file.
5) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-50142)
CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to allocation of resources without limits or throttling in Box_stsz::parse() fixed-size mode when parsing a crafted HEIF sequence file through the public C API. A remote attacker can supply a crafted HEIF sequence file with an excessive sample_count value to cause a denial of service.
Only the file parser is exercised, and no decoder backend is required.
Remediation
Install update from vendor's website.