Libheif CVE-2026-47247

|

EUVD

EUVD-2026-46641 HIGH

Information Exposure (CWE-200)

2026-07-02 vendor:ubuntu

Information Disclosure Libheif Struktur

7.5

CVSS 3.1 · Vendor: vendor:ubuntu

View

Vulnerability Assessment

Weakness

CWE

OWASP Top 10:2025

A01:2025 - Broken Access Control

ASVS 5.0

V14 - Data Protection Data exposure prevention

MITRE ATT&CK

2 techniques across 2 tactics: Collection, Discovery

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

AnalysisAIv2 – Jul 21, 2026

Information disclosure in libheif, the open-source HEIF/HEIC image decoding library, allows remote attackers to read sensitive data (likely uninitialized or out-of-bounds process memory) by supplying a crafted image to any application or service that uses the library to decode untrusted HEIF/HEIC files. The flaw carries CVSS 7.5 with a confidentiality-only impact and no public exploit identified at time of analysis; it was reported via Ubuntu and documented in libheif security advisory GHSA-2vh6-whr3-cmq3. Because libheif is bundled by many Linux distributions and image pipelines, exposure is broad wherever HEIF decoding runs on attacker-supplied input.

Earlier versions of this analysis (1)

v1 Jul 03, 2026 - 23:47

CVE-2026-47247 has been reported by Ubuntu but carries no public description, CVSS score, CWE classification, or technical details at time of analysis. The affected product, vulnerability class, and impact are entirely unknown. No meaningful synthesis is possible from available data - this CVE should be treated as a placeholder or pre-disclosure record pending vendor publication.

Affected VersionsENISA

libheif < 1.22.0

Affected Packages

euvd libheif fix: 1.22.0

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check

Know when Libheif gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (vendor:ubuntu) PRIMARY 7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SUSE 6.2 MEDIUM

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from Vendor (vendor:ubuntu).

CVSS VectorVendor: vendor:ubuntu

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

3

Patch available

Jul 21, 2026 - 23:36 EUVD

Analysis Updated

Jul 21, 2026 - 22:30 vuln.today

v2 - CVSS changed

CVSS changed

Jul 21, 2026 - 22:26 NVD

7.5 (HIGH)

DescriptionCVE.org

[Unknown description]

Executive ViewAI

Why It Matters

A remote information disclosure flaw in libheif, bundled across Linux systems and image-processing applications, creates an unpatched pathway for attackers to extract sensitive data from affected organizations. With no vendor patch currently available, this vulnerability immediately threatens any system processing untrusted HEIF/HEIC image files, requiring urgent mitigation to prevent confidential data leakage.

Recommended Action

Within 24 hours, audit all systems and applications using libheif, document the complete inventory including Linux distribution packages and container images, and disable HEIF/HEIC image processing where operationally feasible. Within 7 days, implement file-type validation and input restrictions on image upload endpoints, restrict network access to image processing services, and review application logs for exploitation attempts or anomalous image processing activity. Within 30 days, establish a vendor monitoring process for patch releases and security advisories specific to CVE-2026-47247, evaluate alternative image libraries without HEIF support, and develop a remediation roadmap contingent on patch availability.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations include: disable HEIF/HEIC image processing in applications where not business-critical; implement strict file-type validation to reject HEIF files at all ingress points; run image processing services in isolated containers with restricted resource access and egress network controls; apply network segmentation to isolate systems performing image processing; monitor system and application logs for indicators of unauthorized data access; consider migrating to alternative image formats (JPEG, WebP, PNG) in systems handling untrusted images.

Threat Intelligence Overview

EPSS Score

0.4%

Top 66% exploitable

Data Quality

7 sources

Confidence: High

EUVD

CVE.org

EPSS Vendor

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.4%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact

High

Priority Score

38

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +38

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in Libheif

View all

CVE-2023-49464 HIGH This Week POC

libheif v1.17.5 was discovered to contain a segmentation violation via the function UncompressedImageCodec::get_luma_bit

CVE-2023-49463 HIGH This Week POC

libheif v1.17.5 was discovered to contain a segmentation violation via the function find_exif_tag at /libheif/exif.cc. R

CVE-2023-49462 HIGH This Week POC

libheif v1.17.5 was discovered to contain a segmentation violation via the component /libheif/exif.cc. Rated high severi

CVE-2023-49460 HIGH This Week POC

libheif v1.17.5 was discovered to contain a segmentation violation via the function UncompressedImageCodec::decode_uncom

CVE-2019-11471 HIGH This Week POC

libheif 1.4.0 has a use-after-free in heif::HeifContext::Image::set_alpha_channel in heif_context.h because heif_context

CVE-2024-41311 HIGH This Week POC

In Libheif 1.17.6, insufficient checks in ImageOverlay::parse() decoding a heif file containing an overlay image with fo

CVE-2024-25269 HIGH This Week POC

libheif <= 1.17.6 contains a memory leak in the function JpegEncoder::Encode. Rated high severity (CVSS 7.5), this vulne

CVE-2025-68431 HIGH This Week POC

Out-of-bounds read in libheif's HEIF/HEIC overlay processing can disclose limited memory contents and crash affected app

CVE-2023-29659 MEDIUM This Month POC

A Segmentation fault caused by a floating point exception exists in libheif 1.15.1 using crafted heif images via the hei

CVE-2025-29482 MEDIUM This Month POC

Buffer Overflow vulnerability in libheif 1.19.7 allows a local attacker to execute arbitrary code via the SAO (Sample Ad

CVE-2026-84383 CRITICAL Act Now

Heap-based buffer overflow in libheif before 1.23.2 allows remote attackers to corrupt memory and potentially achieve co

CVE-2026-32740 HIGH This Week

Heap buffer overflow write in libheif (versions ≤ 1.21.2) lets a crafted HEIF/AVIF file write 64 bytes of attacker-contr

Same weakness CWE-200 – Information Exposure

View all

CVE-2024-24919 HIGH POC

CVE-2021-41277 HIGH POC

CVE-2016-6415 HIGH POC

CVE-2013-7331 MEDIUM POC

CVE-2025-31125 MEDIUM POC

CVE-2025-11749 CRITICAL POC

CVE-2017-16894 HIGH POC

CVE-2017-11165 CRITICAL POC

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

CVE-2021-34523 CRITICAL POC

CVE-2013-2251 CRITICAL POC

CVE-2017-5638 CRITICAL POC

CVE-2025-24813 CRITICAL POC

CVE-2025-68613 HIGH POC

CVE-2015-1701 HIGH POC

CVE-2017-0147 HIGH POC

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
Image SLES-SAP-Azure Image SLES-SAP-Azure-3P Image SLES-SAP-BYOS-Azure Image SLES-SAP-BYOS-EC2 Image SLES-SAP-BYOS-GCE Image SLES-SAP-EC2 Image SLES-SAP-GCE Image SLES-SAPCAL-Azure Image SLES-SAPCAL-EC2 Image SLES-SAPCAL-GCE	Affected
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Module for Desktop Applications 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7	Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP7	Fixed
SUSE Linux Enterprise Server 16.0 SUSE Linux Enterprise Server for SAP applications 16.0	Fixed
SUSE Linux Enterprise Server 16.1	Fixed

References

Advisories & patches

ADVISORY https://vuldb.com/vuln/381198 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22153/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2622/ REF https://github.com/strukturag/libheif/security/advisories/GHSA-2vh6-whr3-cmq3

Search Externally

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy