Skip to main content

Libheif CVE-2026-48029

| EUVDEUVD-2026-47710 HIGH
Out-of-bounds Read (CWE-125)
2026-07-02 vendor:ubuntu
Buffer Overflow Information Disclosure Libheif Struktur
7.1
CVSS 3.1 · Vendor: vendor:ubuntu
View

Vulnerability Assessment

Weakness
CWE
CWE-125
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK

1 technique across 1 tactic: Collection

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv2 – Jul 22, 2026

Out-of-bounds read in the libheif HEIF/HEIC decoding library affects applications that decode grid images carrying a 90 or 270 degree 'irot' rotation property. When a caller requests a tile by its displayed-grid coordinates, libheif validated those coordinates against the file's un-rotated grid dimensions instead of the rotation-swapped displayed dimensions, letting out-of-range coordinates through and producing an unsigned integer underflow in the inverse-rotation math. A crafted file can trigger a read outside the intended bounds, causing a crash (denial of service) and potential minor information disclosure; there is no public exploit identified at time of analysis.

Earlier versions of this analysis (1)
v1 Jul 03, 2026 - 23:36

Insufficient data to produce analysis. CVE-2026-48029 description is marked as unknown; no CVSS, CWE, EPSS, KEV status, or technical details provided. Only source is vendor:ubuntu attribution.

Affected VersionsENISA

libheif 1.19.0, < 1.22.0

Affected Packages

euvd libheif_1_19_0 fix: 1.22.0

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check

Know when Libheif gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (vendor:ubuntu) PRIMARY 7.1 HIGH
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
SUSE 6.1 MEDIUM
AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

Primary rating from Vendor (vendor:ubuntu).

CVSS VectorVendor: vendor:ubuntu

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
High

Lifecycle Timeline

2
Analysis Updated
Jul 22, 2026 - 15:28 vuln.today
v2 - CVSS changed
CVSS changed
Jul 22, 2026 - 15:22 NVD
7.1 (HIGH)

DescriptionCVE.org

[Unknown description]

Executive ViewAI

Why It Matters

A high-severity vulnerability in libheif, a widely-deployed HEIF/HEIC image decoding library, allows attackers to trigger denial-of-service crashes and potentially leak minor information by supplying crafted image files with specific rotation properties. Organizations whose applications or embedded systems process HEIF/HEIC images-including communication platforms, media services, and image processing tools-face service availability risk and should prioritize patching.

Recommended Action

Within 24 hours, inventory all applications, services, and dependencies that use libheif, including embedded instances in third-party image processing tools and media frameworks. Within 7 days, apply the vendor-released patch to affected systems, staging updates first in development and test environments before production rollout. Within 30 days, confirm all libheif instances across the organization have been updated to the patched version, conduct audit log reviews for evidence of exploited crafted HEIF/HEIC files, and document patch deployment status for compliance reporting.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.3%
Top 74% exploitable
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.3%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
No
Human Impact
High

Priority Score

36
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +36
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in Libheif

View all
CVE-2023-49464 HIGH POC
8.8 Dec 07

libheif v1.17.5 was discovered to contain a segmentation violation via the function UncompressedImageCodec::get_luma_bit
CVE-2023-49463 HIGH POC
8.8 Dec 07

libheif v1.17.5 was discovered to contain a segmentation violation via the function find_exif_tag at /libheif/exif.cc. R
CVE-2023-49462 HIGH POC
8.8 Dec 07

libheif v1.17.5 was discovered to contain a segmentation violation via the component /libheif/exif.cc. Rated high severi
CVE-2023-49460 HIGH POC
8.8 Dec 07

libheif v1.17.5 was discovered to contain a segmentation violation via the function UncompressedImageCodec::decode_uncom
CVE-2019-11471 HIGH POC
8.8 Apr 23

libheif 1.4.0 has a use-after-free in heif::HeifContext::Image::set_alpha_channel in heif_context.h because heif_context
CVE-2024-41311 HIGH POC
8.1 Oct 15

In Libheif 1.17.6, insufficient checks in ImageOverlay::parse() decoding a heif file containing an overlay image with fo
CVE-2024-25269 HIGH POC
7.5 Mar 05

libheif <= 1.17.6 contains a memory leak in the function JpegEncoder::Encode. Rated high severity (CVSS 7.5), this vulne
CVE-2025-68431 HIGH POC
7.1

Out-of-bounds read in libheif's HEIF/HEIC overlay processing can disclose limited memory contents and crash affected app
CVE-2023-29659 MEDIUM POC
6.5 May 05

A Segmentation fault caused by a floating point exception exists in libheif 1.15.1 using crafted heif images via the hei
CVE-2025-29482 MEDIUM POC
6.2 Apr 07

Buffer Overflow vulnerability in libheif 1.19.7 allows a local attacker to execute arbitrary code via the SAO (Sample Ad
CVE-2026-84383 CRITICAL
9.8 Sep 04

Heap-based buffer overflow in libheif before 1.23.2 allows remote attackers to corrupt memory and potentially achieve co
CVE-2026-32740 HIGH
8.8 May 19

Heap buffer overflow write in libheif (versions ≤ 1.21.2) lets a crafted HEIF/AVIF file write 64 bytes of attacker-contr

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Image SLES-SAP-Azure Image SLES-SAP-Azure-3P Image SLES-SAP-BYOS-Azure Image SLES-SAP-BYOS-EC2 Image SLES-SAP-BYOS-GCE Image SLES-SAP-EC2 Image SLES-SAP-GCE Image SLES-SAPCAL-Azure Image SLES-SAPCAL-EC2 Image SLES-SAPCAL-GCE Affected
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Module for Desktop Applications 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP7 Fixed
SUSE Linux Enterprise Server 16.0 SUSE Linux Enterprise Server for SAP applications 16.0 Fixed
SUSE Linux Enterprise Server 16.1 Fixed

References

Advisories & patches
ADVISORY https://ubuntu.com/security/notices/USN-8526-1 ADVISORY https://vuldb.com/vuln/382367 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22153/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2622/ REF https://github.com/strukturag/libheif/commit/e523ec0bf379110b7c33d4c159f8b1202d332157 REF https://github.com/strukturag/libheif/security/advisories/GHSA-6x5f-qchq-cxqv

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy