CVE-2026-47178

libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.19.0 through 1.21.2, a crafted HEIF file (uncompressed unci codec, tiled, component-interleaved, 4:2:0) triggers a heap out-of-bounds write in libheif's uncompressed tile decoder. The write overwrites the C++ vtable pointer of an adjacent unc_decoder_component_interleave object; the next virtual call dispatches to an attacker-chosen address. Version 1.22.0 patches the issue.

Database specific

{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-787"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47178.json"
}

References

Affected packages

Git / github.com/strukturag/libheif

Affected ranges

Type

GIT

Repo

https://github.com/strukturag/libheif

Events

Introduced

c4e4657dcf6bcc06e934632f97736f7c78dbff9e

Fixed

0c81a846b7401dbdb7118afd0761057f21e43511

Database specific

Show details

{
    "cpe":  "cpe:2.3:a:struktur:libheif:*:*:*:*:*:*:*:*",
    "extracted_events":  [
        {
            "introduced":  "1.19.0"
        },
        {
            "fixed":  "1.22.0"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ]
}

Affected versions

v1.*

v1.19.0

v1.19.1

v1.19.2

v1.19.3

v1.19.4

v1.19.5

v1.20.0

v1.20.1

v1.21.0

v1.21.1

v1.21.2

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-47178.json"

vanir_signatures

[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "175107675317900759648359576881034358256",
                "220432159010798240840908416937024023837",
                "268268967745545109707798594937166387611",
                "253707932335489477155115861206639265538",
                "199679408075604976163979654915891773303",
                "175107675317900759648359576881034358256",
                "220432159010798240840908416937024023837",
                "268268967745545109707798594937166387611",
                "286778284410146987248233194002847271266",
                "178248309108630471590778685235254536836"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-47178-91619f1d",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/strukturag/libheif/commit/0c81a846b7401dbdb7118afd0761057f21e43511",
        "target":  {
            "file":  "tests/uncompressed_box.cc"
        }
    }
]

vanir_signatures_modified

"2026-09-10T08:21:17Z"