Unknown (Ubuntu reported) EUVD-2026-46451

| CVE-2026-47709 MEDIUM

NULL Pointer Dereference (CWE-476)

2026-07-02 vendor:ubuntu

Denial Of Service Null Pointer Dereference Libheif Struktur

6.9

CVSS 4.0 · Vendor: vendor:ubuntu

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Cannot construct without vulnerability description and CVSS attack vector.

Vulnerability Assessment

Weakness	CWE CWE-476 OWASP Top 10:2025 A10:2025 - Mishandling of Exceptional Conditions ASVS 5.0 V16 - Security Logging and Error Handling Null pointer safety, defensive checks MITRE ATT&CK 1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Unknown - no description or CVSS vector data available to determine whether unauthenticated remote exploitation is possible or if special conditions (authentication, local access, specific configuration) are required.
Impact	Risk assessment is not possible. CVSS vector is missing (required for attack vector, complexity, privileges analysis), EPSS score is not provided, KEV status is unknown, POC availability is unknown, and exploitation conditions cannot be determined from an absent description.
Exploit ScenarioDerived	Attack scenario cannot be constructed without the CVE description, affected product, attack vector, and exploitation prerequisites.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

AnalysisAIv1 – Jul 03, 2026

Insufficient intelligence to synthesize. CVE-2026-47709 description is marked unknown, CVSS vector is not available, CWE is not available, and no product name or affected versions are specified - only that Ubuntu reported it. Comprehensive vulnerability analysis requires description, CVSS vector, affected product details, and remediation data.

RemediationAI

No remediation guidance can be provided without product identification, affected version information, and patch status. Contact the reporting vendor (Ubuntu) for affected package details and security advisories.

Affected VersionsENISA

libheif < 1.22.0

Affected Packages

euvd libheif fix: 1.22.0

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check

Technical ContextAI · show details

No technical context available. CVE description is unknown, CWE is not provided, and no product name or affected technology is identified in the input data.

Know when Libheif gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (vendor:ubuntu) PRIMARY 6.9 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE 6.2 MEDIUM

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (vendor:ubuntu).

CVSS VectorVendor: vendor:ubuntu

Attack Vector

Local

Attack Complexity

Low

Attack Requirements

None

Privileges Required

None

User Interaction

None

Vulnerable system: Confidentiality

None

Vulnerable system: Integrity

None

Vulnerable system: Availability

High

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

Lifecycle Timeline

1

CVSS changed

Jul 21, 2026 - 22:26 NVD

6.9 (MEDIUM)

DescriptionCVE.org

[Unknown description]

Threat Intelligence Overview

EPSS Score

0.2%

Top 92% exploitable

Data Quality

7 sources

Confidence: High

EUVD

CVE.org

EPSS Vendor

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Defer

Exploitation· derived

None

System Exposure· derived

Small

Automatable· derived

No

Human Impact· derived

Medium

Priority Score

34

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +34

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Null Pointer Dereference MEDIUM

A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Libheif

View all

CVE-2023-49464 HIGH This Week POC

libheif v1.17.5 was discovered to contain a segmentation violation via the function UncompressedImageCodec::get_luma_bit

CVE-2023-49463 HIGH This Week POC

libheif v1.17.5 was discovered to contain a segmentation violation via the function find_exif_tag at /libheif/exif.cc. R

CVE-2023-49462 HIGH This Week POC

libheif v1.17.5 was discovered to contain a segmentation violation via the component /libheif/exif.cc. Rated high severi

CVE-2023-49460 HIGH This Week POC

libheif v1.17.5 was discovered to contain a segmentation violation via the function UncompressedImageCodec::decode_uncom

CVE-2019-11471 HIGH This Week POC

libheif 1.4.0 has a use-after-free in heif::HeifContext::Image::set_alpha_channel in heif_context.h because heif_context

CVE-2024-41311 HIGH This Week POC

In Libheif 1.17.6, insufficient checks in ImageOverlay::parse() decoding a heif file containing an overlay image with fo

CVE-2024-25269 HIGH This Week POC

libheif <= 1.17.6 contains a memory leak in the function JpegEncoder::Encode. Rated high severity (CVSS 7.5), this vulne

CVE-2025-68431 HIGH This Week POC

Out-of-bounds read in libheif's HEIF/HEIC overlay processing can disclose limited memory contents and crash affected app

CVE-2023-29659 MEDIUM This Month POC

A Segmentation fault caused by a floating point exception exists in libheif 1.15.1 using crafted heif images via the hei

CVE-2025-29482 MEDIUM This Month POC

Buffer Overflow vulnerability in libheif 1.19.7 allows a local attacker to execute arbitrary code via the SAO (Sample Ad

CVE-2026-84383 CRITICAL Act Now

Heap-based buffer overflow in libheif before 1.23.2 allows remote attackers to corrupt memory and potentially achieve co

CVE-2026-32740 HIGH This Week

Heap buffer overflow write in libheif (versions ≤ 1.21.2) lets a crafted HEIF/AVIF file write 64 bytes of attacker-contr

Same weakness CWE-476 – NULL Pointer Dereference

View all

CVE-2016-0742 HIGH

CVE-2014-3470 MEDIUM

CVE-2020-1967 HIGH POC

CVE-2017-3730 HIGH POC

CVE-2017-3169 CRITICAL POC

CVE-2016-4957 HIGH

CVE-2021-3449 MEDIUM

CVE-2015-3194 HIGH

Same technique Denial Of Service

View all

CVE-2015-5119 CRITICAL POC

CVE-2011-2462 CRITICAL POC

CVE-2011-0611 HIGH POC

CVE-2012-1889 HIGH POC

CVE-2012-0507 CRITICAL POC

CVE-2014-1761 HIGH POC

CVE-2015-5122 CRITICAL POC

CVE-2011-0609 HIGH POC

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
Image SLES-SAP-Azure Image SLES-SAP-Azure-3P Image SLES-SAP-BYOS-Azure Image SLES-SAP-BYOS-EC2 Image SLES-SAP-BYOS-GCE Image SLES-SAP-EC2 Image SLES-SAP-GCE Image SLES-SAPCAL-Azure Image SLES-SAPCAL-EC2 Image SLES-SAPCAL-GCE	Affected
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Module for Desktop Applications 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7	Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP7	Fixed
SUSE Linux Enterprise Server 16.0 SUSE Linux Enterprise Server for SAP applications 16.0	Fixed
SUSE Linux Enterprise Server 16.1	Fixed

References

Advisories & patches

ADVISORY https://ubuntu.com/security/notices/USN-8526-1 ADVISORY https://vuldb.com/vuln/381299 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22153/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2622/ REF https://github.com/strukturag/libheif/issues/1802 REF https://github.com/strukturag/libheif/pull/1806 REF https://github.com/strukturag/libheif/security/advisories/GHSA-4h72-vqgp-9376

Search Externally

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy