CVE-2026-47254
6.1
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Summary
libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, Track::init_sample_timing_table() in libheif/sequences/track.cc stores an out-of-bounds chunk index (m_chunks.size()) into m_presentation_timeline when the number of chunks defined in the stco box is less than the number of samples in stsz. A subsequent call to heif_track_get_next_raw_sequence_sample() reads m_chunks[chunk_idx] with that OOB index, causing a heap-buffer-overflow. Version 1.22.0 fixes the issue.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| strukturag | libheif | < 1.22.0 | affected |
Weaknesses
- CWE-125: CWE-125: Out-of-bounds Read
References
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.