Heap information disclosure in libheif grid image decoding (CVE-2026-47247)

Two chained bugs in libheif allow an attacker to leak process heap memory as visible pixel values in decoded grid images. An uninitialized pixel plane allocation (pixelimage.cc:684) combined with an integer-division gap in the grid coverage check (grid.cc:354) causes unwritten heap bytes to appear as renderable pixels. A remote attacker can upload a crafted AVIF/HEIC file to any server-side image processor and recover heap contents - including function pointers sufficient to defeat ASLR - from the publicly downloadable transcoded output. Affected versions: - <= 1.21.2 We recommend updating to: v1.22.0. CVSS 7.5 · our assessment: this_week Reference: https://github.com/strukturag/libheif/security/advisories/GHSA-2vh6-whr3-cmq3 Details: https://vuln.today/cve/CVE-2026-47247