Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-47247

libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, two bugs in libheif chain to leak process heap memory as visible pixel values in decoded grid images. An attacker who uploads a crafted AVIF/HEIC file to any server-side image processor (WordPress, Sharp/libvips, ImageMagick, etc.) can recover heap data - including library function pointers sufficient to defeat ASLR, or any other secret - from the publicly-downloadable transcoded JPEG/PNG/WebP output. Local atta
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:be3298dfb413b5694ba478864053a0c329e432dc862c0bc7d3caca640e133929
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
1

Preserved source conflicts

No provider value was silently selected as the winner.

cwe · 4 assertions

{"cweId":"CWE-226","description":"CWE-226: Sensitive Information in Resource Not Removed Before Reuse","lang":"en","type":"CWE"}

  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:92a79335eb92f03def0190b227cd948295e0ff1e403b4ead0a9244c795a4d8a2 · sha256:3305b19643645c07… · /containers/cna/problemTypes/1/descriptions/0

{"cweId":"CWE-200","description":"CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","lang":"en","type":"CWE"}

  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:92a79335eb92f03def0190b227cd948295e0ff1e403b4ead0a9244c795a4d8a2 · sha256:3305b19643645c07… · /containers/cna/problemTypes/0/descriptions/0

{"cweId":"CWE-908","description":"CWE-908: Use of Uninitialized Resource","lang":"en","type":"CWE"}

  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:92a79335eb92f03def0190b227cd948295e0ff1e403b4ead0a9244c795a4d8a2 · sha256:3305b19643645c07… · /containers/cna/problemTypes/3/descriptions/0

{"cweId":"CWE-682","description":"CWE-682: Incorrect Calculation","lang":"en","type":"CWE"}

  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:92a79335eb92f03def0190b227cd948295e0ff1e403b4ead0a9244c795a4d8a2 · sha256:3305b19643645c07… · /containers/cna/problemTypes/2/descriptions/0

Affected products and versions

1 source assertion
{"product":"libheif","vendor":"strukturag","versions":[{"status":"affected","version":"< 1.22.0"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:92a79335eb92f03def0190b227cd948295e0ff1e403b4ead0a9244c795a4d8a2 · sha256:3305b19643645c07… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion
{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"metric_type":"cvssV3_1"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:92a79335eb92f03def0190b227cd948295e0ff1e403b4ead0a9244c795a4d8a2 · sha256:3305b19643645c07… · /containers/cna/metrics/0/cvssV3_1

CWE assertions

4 source assertions
{"cweId":"CWE-226","description":"CWE-226: Sensitive Information in Resource Not Removed Before Reuse","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:92a79335eb92f03def0190b227cd948295e0ff1e403b4ead0a9244c795a4d8a2 · sha256:3305b19643645c07… · /containers/cna/problemTypes/1/descriptions/0
{"cweId":"CWE-200","description":"CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:92a79335eb92f03def0190b227cd948295e0ff1e403b4ead0a9244c795a4d8a2 · sha256:3305b19643645c07… · /containers/cna/problemTypes/0/descriptions/0
{"cweId":"CWE-908","description":"CWE-908: Use of Uninitialized Resource","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:92a79335eb92f03def0190b227cd948295e0ff1e403b4ead0a9244c795a4d8a2 · sha256:3305b19643645c07… · /containers/cna/problemTypes/3/descriptions/0
{"cweId":"CWE-682","description":"CWE-682: Incorrect Calculation","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:92a79335eb92f03def0190b227cd948295e0ff1e403b4ead0a9244c795a4d8a2 · sha256:3305b19643645c07… · /containers/cna/problemTypes/2/descriptions/0

Source references

2 source assertions
{"tags":["exploit"],"url":"https://github.com/strukturag/libheif/security/advisories/GHSA-2vh6-whr3-cmq3"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:92a79335eb92f03def0190b227cd948295e0ff1e403b4ead0a9244c795a4d8a2 · sha256:3305b19643645c07… · /containers/adp/0/references/0
{"name":"https://github.com/strukturag/libheif/security/advisories/GHSA-2vh6-whr3-cmq3","tags":["x_refsource_CONFIRM"],"url":"https://github.com/strukturag/libheif/security/advisories/GHSA-2vh6-whr3-cmq3"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:92a79335eb92f03def0190b227cd948295e0ff1e403b4ead0a9244c795a4d8a2 · sha256:3305b19643645c07… · /containers/cna/references/0

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer