CVE-2026-47709 — Security Box Score

CVE · referencelatest edition

Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-47709MEDIUM

strukturag libheif — libheif has a NULL pointer dereference in heif_image_handle_get_image_tiling for malformed unci image missing ispe

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   L   L   N   N   N   N   N   H    6.9   .0021   11.8     —

AFFECTED
  Product  Versions    Fixed
  libheif  < 1.22.0 –  —

TIMELINE
  May 19  Reserved by GitHub_M
  Jul 21  EXPLOIT PUBLISHED — CVE-2026-47709 (strukturag libheif). Public exploit reference added.
  Jul 21  Published (CNA: GitHub_M)
  Jul 27  EXPLOIT PUBLISHED — CVE-2026-47709 (strukturag libheif). Public exploit reference added.

CWE-476 · CNA: GitHub_M · CVSS v4.0 · 3 references · NVD status: Analyzed

Description

libheif is a HEIF and AVIF file format decoder and encoder. Versions prior to 1.22.0 crashes in the public C API `heif_image_handle_get_image_tiling()` when a malformed uncompressed HEIF image item has an associated `uncC` property but no associated `ispe` property. In debug builds this trips the `ispe && uncC` assertion in `ImageItem_uncompressed::get_heif_image_tiling()`. In a release/NDEBUG ASan build, the same file causes a null pointer read at address `0xa8`. Version 1.22.0 fixes the issue.

Lifecycle

Complete event history — 4 events, chronological
Date	Event	Detail
May 19, 2026	Reserved	Reserved by GitHub_M
July 21, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-47709 (strukturag libheif). Public exploit reference added.
July 21, 2026	Published	Published (CNA: GitHub_M)
July 27, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-47709 (strukturag libheif). Public exploit reference added.

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
strukturag	libheif	—	< 1.22.0	—

Weaknesses

CWE-476

References (3)

https://github.com/strukturag/libheif/issues/1802 [Exploit, Issue Tracking, Third Party Advisory]
https://github.com/strukturag/libheif/pull/1806 [Exploit, Issue Tracking, Patch, Third Party Advisory]
https://github.com/strukturag/libheif/security/advisories/GHSA-4h72-vqgp-9376 [Exploit, Vendor Advisory, Mitigation]

Authoritative record: CVE-2026-47709 at cve.org

Vendors: strukturag

Weaknesses: CWE-476

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-47709 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.