CVE-2026-47251 libheif has an incomplete fix for CVE-2026-3949: integer overflow bypass in vvdec_push_data2
An integer overflow in libheif's security check allows crafted HEIF files to trigger out-of-bounds heap reads, potentially causing crashes or data leaks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-47251?
CVE-2026-47251 is a medium-severity vulnerability in strukturag libheif, published on 21 Jul 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
libheif is a HEIF and AVIF file format decoder and encoder. The fix for CVE-2026-3949 (commit `b97c8b5`, PR #1712) introduced an integer overflow in the very security check it added. The check itself can be bypassed, allowing a crafted HEIF file with a VVC track to trigger the same out-of-bounds heap read that CVE-2026-3949 was meant to prevent. This is a separate, currently-unpatched vulnerability. Issue #1712 was closed as fixed without testing the edge case where `size` is near `UINT32_MAX`. Version 1.22.0 patches the issue.
Which versions are affected by CVE-2026-47251?
It affects 1 product.
Products include Struktur Libheif.
How do I fix CVE-2026-47251?
Upgrade to a fixed version.
Is CVE-2026-47251 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-47251 exists.
Other vulnerabilities in strukturag libheif
Sources
Also known as BELL-CVE-2026-47251, ECHO-1888-e250-4427, GHSA-p6q9-fhf2-vj9v, JLSEC-2026-1097.