GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

USN-8526-1 (UBUNTU-CVE-2026-47254)

Vulnerability from osv_ubuntu – Published: 2026-07-09 19:25 – Updated: 2026-08-20 07:42 – Source website
VLAI
Summary
libheif vulnerabilities
Details

Xianrui Dong discovered that libheif had an out-of-bounds read in its HEIF sequence track parser. An attacker could possibly use this issue to cause a denial of service or obtain sensitive information. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-47254)

Junyi Liu discovered that libheif had a null pointer dereference in its image tiling interface. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-47709)

Calvin Young and Enoch Chow discovered that libheif had an integer overflow in its inline mask size calculation. An attacker could possibly use this issue to cause a denial of service or obtain sensitive information. (CVE-2026-47714)

Ariel Koren discovered that libheif had an integer underflow in its grid image tile coordinate transform. An attacker could possibly use this issue to cause a denial of service or obtain sensitive information. (CVE-2026-48029)

It was discovered that libheif had a missing bound check in its HEIF sequence parser, allowing unbounded heap allocation. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-50142)

References
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2026-47709",
              "severity": [
                {
                  "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
                  "type": "CVSS_V4"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-47714",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-48029",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-50142",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:25.10"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "heif-gdk-pixbuf",
            "binary_version": "1.20.2-1ubuntu0.6"
          },
          {
            "binary_name": "heif-thumbnailer",
            "binary_version": "1.20.2-1ubuntu0.6"
          },
          {
            "binary_name": "heif-view",
            "binary_version": "1.20.2-1ubuntu0.6"
          },
          {
            "binary_name": "libheif-examples",
            "binary_version": "1.20.2-1ubuntu0.6"
          },
          {
            "binary_name": "libheif-plugin-aomdec",
            "binary_version": "1.20.2-1ubuntu0.6"
          },
          {
            "binary_name": "libheif-plugin-aomenc",
            "binary_version": "1.20.2-1ubuntu0.6"
          },
          {
            "binary_name": "libheif-plugin-dav1d",
            "binary_version": "1.20.2-1ubuntu0.6"
          },
          {
            "binary_name": "libheif-plugin-ffmpegdec",
            "binary_version": "1.20.2-1ubuntu0.6"
          },
          {
            "binary_name": "libheif-plugin-j2kdec",
            "binary_version": "1.20.2-1ubuntu0.6"
          },
          {
            "binary_name": "libheif-plugin-j2kenc",
            "binary_version": "1.20.2-1ubuntu0.6"
          },
          {
            "binary_name": "libheif-plugin-jpegdec",
            "binary_version": "1.20.2-1ubuntu0.6"
          },
          {
            "binary_name": "libheif-plugin-jpegenc",
            "binary_version": "1.20.2-1ubuntu0.6"
          },
          {
            "binary_name": "libheif-plugin-kvazaar",
            "binary_version": "1.20.2-1ubuntu0.6"
          },
          {
            "binary_name": "libheif-plugin-libde265",
            "binary_version": "1.20.2-1ubuntu0.6"
          },
          {
            "binary_name": "libheif-plugin-rav1e",
            "binary_version": "1.20.2-1ubuntu0.6"
          },
          {
            "binary_name": "libheif-plugin-svtenc",
            "binary_version": "1.20.2-1ubuntu0.6"
          },
          {
            "binary_name": "libheif-plugin-x265",
            "binary_version": "1.20.2-1ubuntu0.6"
          },
          {
            "binary_name": "libheif-plugins-all",
            "binary_version": "1.20.2-1ubuntu0.6"
          },
          {
            "binary_name": "libheif1",
            "binary_version": "1.20.2-1ubuntu0.6"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:25.10",
        "name": "libheif",
        "purl": "pkg:deb/ubuntu/libheif@1.20.2-1ubuntu0.6?arch=source\u0026distro=questing"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.20.2-1ubuntu0.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.19.7-1",
        "1.19.8-1",
        "1.20.2-1",
        "1.20.2-1ubuntu0.1",
        "1.20.2-1ubuntu0.3",
        "1.20.2-1ubuntu0.4",
        "1.20.2-1ubuntu0.5"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2026-47254",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-47709",
              "severity": [
                {
                  "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
                  "type": "CVSS_V4"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-47714",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-48029",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-50142",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:26.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "heif-gdk-pixbuf",
            "binary_version": "1.21.2-3ubuntu0.3"
          },
          {
            "binary_name": "heif-thumbnailer",
            "binary_version": "1.21.2-3ubuntu0.3"
          },
          {
            "binary_name": "heif-view",
            "binary_version": "1.21.2-3ubuntu0.3"
          },
          {
            "binary_name": "libheif-examples",
            "binary_version": "1.21.2-3ubuntu0.3"
          },
          {
            "binary_name": "libheif-plugin-aomdec",
            "binary_version": "1.21.2-3ubuntu0.3"
          },
          {
            "binary_name": "libheif-plugin-aomenc",
            "binary_version": "1.21.2-3ubuntu0.3"
          },
          {
            "binary_name": "libheif-plugin-dav1d",
            "binary_version": "1.21.2-3ubuntu0.3"
          },
          {
            "binary_name": "libheif-plugin-ffmpegdec",
            "binary_version": "1.21.2-3ubuntu0.3"
          },
          {
            "binary_name": "libheif-plugin-j2kdec",
            "binary_version": "1.21.2-3ubuntu0.3"
          },
          {
            "binary_name": "libheif-plugin-j2kenc",
            "binary_version": "1.21.2-3ubuntu0.3"
          },
          {
            "binary_name": "libheif-plugin-jpegdec",
            "binary_version": "1.21.2-3ubuntu0.3"
          },
          {
            "binary_name": "libheif-plugin-jpegenc",
            "binary_version": "1.21.2-3ubuntu0.3"
          },
          {
            "binary_name": "libheif-plugin-kvazaar",
            "binary_version": "1.21.2-3ubuntu0.3"
          },
          {
            "binary_name": "libheif-plugin-libde265",
            "binary_version": "1.21.2-3ubuntu0.3"
          },
          {
            "binary_name": "libheif-plugin-rav1e",
            "binary_version": "1.21.2-3ubuntu0.3"
          },
          {
            "binary_name": "libheif-plugin-svtenc",
            "binary_version": "1.21.2-3ubuntu0.3"
          },
          {
            "binary_name": "libheif-plugin-x265",
            "binary_version": "1.21.2-3ubuntu0.3"
          },
          {
            "binary_name": "libheif-plugins-all",
            "binary_version": "1.21.2-3ubuntu0.3"
          },
          {
            "binary_name": "libheif1",
            "binary_version": "1.21.2-3ubuntu0.3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "libheif",
        "purl": "pkg:deb/ubuntu/libheif@1.21.2-3ubuntu0.3?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.21.2-3ubuntu0.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.20.2-1",
        "1.20.2-2",
        "1.20.2-2build1",
        "1.20.2-2build2",
        "1.20.2-2ubuntu1",
        "1.21.2-1",
        "1.21.2-3",
        "1.21.2-3ubuntu0.1",
        "1.21.2-3ubuntu0.2"
      ]
    }
  ],
  "aliases": [],
  "details": "Xianrui Dong discovered that libheif had an out-of-bounds read in its\nHEIF sequence track parser. An attacker could possibly use this issue\nto cause a denial of service or obtain sensitive information. This issue\nonly affected Ubuntu 26.04 LTS. (CVE-2026-47254)\n\nJunyi Liu discovered that libheif had a null pointer dereference in its\nimage tiling interface. An attacker could possibly use this issue to\ncause a denial of service. (CVE-2026-47709)\n\nCalvin Young and Enoch Chow discovered that libheif had an integer\noverflow in its inline mask size calculation. An attacker could\npossibly use this issue to cause a denial of service or obtain sensitive\ninformation. (CVE-2026-47714)\n\nAriel Koren discovered that libheif had an integer underflow in its\ngrid image tile coordinate transform. An attacker could possibly use\nthis issue to cause a denial of service or obtain sensitive information.\n(CVE-2026-48029)\n\nIt was discovered that libheif had a missing bound check in its HEIF\nsequence parser, allowing unbounded heap allocation. An attacker could\npossibly use this issue to cause a denial of service. (CVE-2026-50142)",
  "id": "USN-8526-1",
  "modified": "2026-08-20T07:42:25Z",
  "published": "2026-07-09T19:25:53Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-8526-1"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-47254"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-47709"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-47714"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-48029"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-50142"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "summary": "libheif vulnerabilities",
  "upstream": [
    "UBUNTU-CVE-2026-47254",
    "UBUNTU-CVE-2026-47709",
    "UBUNTU-CVE-2026-47714",
    "UBUNTU-CVE-2026-48029",
    "UBUNTU-CVE-2026-50142"
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.