Skip to main content

Libheif CVE-2026-47247

| EUVDEUVD-2026-46641 HIGH
Information Exposure (CWE-200)
2026-07-02 vendor:ubuntu
7.5
CVSS 3.1 · Vendor: vendor:ubuntu
Share

Severity by source

Vendor (vendor:ubuntu) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
SUSE
6.2 MEDIUM
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from Vendor (vendor:ubuntu).

CVSS VectorVendor: vendor:ubuntu

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

5
Patch available
Jul 21, 2026 - 23:36 EUVD
Analysis Updated
Jul 21, 2026 - 22:30 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jul 21, 2026 - 22:26 vuln.today
cvss_changed
CVSS changed
Jul 21, 2026 - 22:26 NVD
7.5 (HIGH)
Analysis Generated
Jul 03, 2026 - 23:47 vuln.today

DescriptionCVE.org

[Unknown description]

AnalysisAI

Information disclosure in libheif, the open-source HEIF/HEIC image decoding library, allows remote attackers to read sensitive data (likely uninitialized or out-of-bounds process memory) by supplying a crafted image to any application or service that uses the library to decode untrusted HEIF/HEIC files. The flaw carries CVSS 7.5 with a confidentiality-only impact and no public exploit identified at time of analysis; it was reported via Ubuntu and documented in libheif security advisory GHSA-2vh6-whr3-cmq3. Because libheif is bundled by many Linux distributions and image pipelines, exposure is broad wherever HEIF decoding runs on attacker-supplied input.

CVE-2023-49464 HIGH POC
8.8 Dec 07

libheif v1.17.5 was discovered to contain a segmentation violation via the function UncompressedImageCodec::get_luma_bit

CVE-2023-49463 HIGH POC
8.8 Dec 07

libheif v1.17.5 was discovered to contain a segmentation violation via the function find_exif_tag at /libheif/exif.cc. R

CVE-2023-49462 HIGH POC
8.8 Dec 07

libheif v1.17.5 was discovered to contain a segmentation violation via the component /libheif/exif.cc. Rated high severi

CVE-2023-49460 HIGH POC
8.8 Dec 07

libheif v1.17.5 was discovered to contain a segmentation violation via the function UncompressedImageCodec::decode_uncom

CVE-2019-11471 HIGH POC
8.8 Apr 23

libheif 1.4.0 has a use-after-free in heif::HeifContext::Image::set_alpha_channel in heif_context.h because heif_context

CVE-2024-41311 HIGH POC
8.1 Oct 15

In Libheif 1.17.6, insufficient checks in ImageOverlay::parse() decoding a heif file containing an overlay image with fo

CVE-2024-25269 HIGH POC
7.5 Mar 05

libheif <= 1.17.6 contains a memory leak in the function JpegEncoder::Encode. Rated high severity (CVSS 7.5), this vulne

CVE-2023-29659 MEDIUM POC
6.5 May 05

A Segmentation fault caused by a floating point exception exists in libheif 1.15.1 using crafted heif images via the hei

CVE-2025-29482 MEDIUM POC
6.2 Apr 07

Buffer Overflow vulnerability in libheif 1.19.7 allows a local attacker to execute arbitrary code via the SAO (Sample Ad

CVE-2026-32740 HIGH
8.8 May 19

Heap buffer overflow write in libheif (versions ≤ 1.21.2) lets a crafted HEIF/AVIF file write 64 bytes of attacker-contr

CVE-2026-47178 HIGH
7.8 Jul 21

Arbitrary code execution in libheif 1.19.0 through 1.21.2 via a crafted HEIF file with uncompressed, tiled, component-in

CVE-2023-0996 HIGH
7.8 Feb 24

There is a vulnerability in the strided image data parsing code in the emscripten wrapper for libheif. Rated high severi

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Image SLES-SAP-Azure Image SLES-SAP-Azure-3P Image SLES-SAP-BYOS-Azure Image SLES-SAP-BYOS-EC2 Image SLES-SAP-BYOS-GCE Image SLES-SAP-EC2 Image SLES-SAP-GCE Image SLES-SAPCAL-Azure Image SLES-SAPCAL-EC2 Image SLES-SAPCAL-GCE Affected
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Module for Desktop Applications 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP7 Fixed
SUSE Linux Enterprise Server 16.0 SUSE Linux Enterprise Server for SAP applications 16.0 Fixed
SUSE Linux Enterprise Server 16.1 Fixed

Share

CVE-2026-47247 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy