Out-of-bounds read in libheif - CVE-2026-49271
Published: June 26, 2026
Vulnerability identifier: #VU135510
CSH Severity: Medium
CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-49271
CWE-ID: CWE-125
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to an out-of-bounds read in unc_decoder::get_compressed_image_data_uncompressed when parsing a crafted HEIF file with wrapped icef compressed-unit offsets and sizes. A remote attacker can supply a specially crafted HEIF file to cause a denial of service.
The issue is reached when the cmpC compressed unit type is not image_tile, and user interaction is required to decode the crafted media.
Affected software
libheif
Debian Linux
Fedora
Ubuntu
libheif (Debian package)
libheif (Ubuntu package)
libheif
aom
Debian Linux
Fedora
Ubuntu
libheif (Debian package)
libheif (Ubuntu package)
libheif
aom
How to mitigate CVE-2026-49271
Install security update from vendor's website.
libheif - update to 1.22.1
libheif (Debian package) - update to 1.19.8-1+deb13u1
libheif (Ubuntu package) - addressed in versions 1.20.2-1ubuntu0.5, 1.21.2-3ubuntu0.2
libheif - addressed in versions 1.23.5-3.el10_3, 1.23.5-3.el10_4
aom - addressed in versions 3.13.3-1.el10_3, 3.13.3-1.el10_4
libheif (Debian package) - update to 1.19.8-1+deb13u1
libheif (Ubuntu package) - addressed in versions 1.20.2-1ubuntu0.5, 1.21.2-3ubuntu0.2
libheif - addressed in versions 1.23.5-3.el10_3, 1.23.5-3.el10_4
aom - addressed in versions 3.13.3-1.el10_3, 3.13.3-1.el10_4