NULL pointer dereference in libheif - CVE-2026-47709
Published: May 20, 2026
Vulnerability identifier: #VU131958
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-47709
CWE-ID: CWE-476
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a null pointer dereference in heif_image_handle_get_image_tiling() when processing a malformed uncompressed HEIF image item missing the ispe property. A remote attacker can supply a specially crafted HEIF file to cause a denial of service.
The issue is reachable through the public C API and may trigger an assertion in debug builds.
Affected software
libheif
Debian Linux
Ubuntu
libheif (Ubuntu package)
libheif (Debian package)
Debian Linux
Ubuntu
libheif (Ubuntu package)
libheif (Debian package)
How to mitigate CVE-2026-47709
Install security update from vendor's website.
libheif - update to 1.22.0
libheif (Ubuntu package) - addressed in versions 1.17.6-1ubuntu4.6, 1.20.2-1ubuntu0.6, 1.21.2-3ubuntu0.3
libheif (Debian package) - update to 1.19.8-1+deb13u1
libheif (Ubuntu package) - addressed in versions 1.17.6-1ubuntu4.6, 1.20.2-1ubuntu0.6, 1.21.2-3ubuntu0.3
libheif (Debian package) - update to 1.19.8-1+deb13u1