Out-of-bounds Read in Strukturag Libheif
CVE-2026-47251
libheif is a HEIF and AVIF file format decoder and encoder. The fix for CVE-2026-3949 (commit `b97c8b5`, PR #1712) introduced an integer overflow in the very security check it added. The check itself can be bypassed, allowing a crafted HEI…
Vulnerability class: Buffer Overflow
Affected products
- Strukturag Libheif — versions < 1.22.0
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM)
- security-advisories@github.com (x_refsource_MISC)