Out-of-bounds read in libheif - CVE-2026-48029
Published: May 20, 2026 / Updated: July 24, 2026
Vulnerability identifier: #VU131986
CSH Severity: Medium
CVSS v4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-48029
CWE-ID: CWE-125
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service and disclose sensitive information.
The vulnerability exists due to out-of-bounds read in ImageItem_Grid::decode_grid_tile when parsing a crafted HEIF/HEIC file containing a grid-derived item with an irot rotation property. A remote attacker can send a specially crafted file to cause a denial of service and disclose sensitive information.
User interaction is required to open or decode the crafted file.
Affected software
libheif
Debian Linux
Fedora
Ubuntu
libheif (Debian package)
libheif (Ubuntu package)
libheif
aom
Debian Linux
Fedora
Ubuntu
libheif (Debian package)
libheif (Ubuntu package)
libheif
aom
How to mitigate CVE-2026-48029
Install security update from vendor's website.
libheif - update to 1.22.0
libheif (Debian package) - update to 1.19.8-1+deb13u1
libheif (Ubuntu package) - addressed in versions 1.20.2-1ubuntu0.6, 1.21.2-3ubuntu0.3
libheif - addressed in versions 1.23.5-3.el10_3, 1.23.5-3.el10_4
aom - addressed in versions 3.13.3-1.el10_3, 3.13.3-1.el10_4
libheif (Debian package) - update to 1.19.8-1+deb13u1
libheif (Ubuntu package) - addressed in versions 1.20.2-1ubuntu0.6, 1.21.2-3ubuntu0.3
libheif - addressed in versions 1.23.5-3.el10_3, 1.23.5-3.el10_4
aom - addressed in versions 3.13.3-1.el10_3, 3.13.3-1.el10_4