CVE-2026-47709CWE-476

libheif has a NULL pointer dereference in heif_image_handle_get_image_tiling for malformed unci image missing ispe

Medium · published July 21, 2026

CVSS v4.0
6.9
EPSS
0%
Percentile
7.4
In the wild
Unconfirmed
What it is

libheif is a HEIF and AVIF file format decoder and encoder. Versions prior to 1.22.0 crashes in the public C API `heif_image_handle_get_image_tiling()` when a malformed uncompressed HEIF image item has an associated `uncC` property but no associated `ispe` property. In debug builds this trips the `ispe && uncC` assertion in `ImageItem_uncompressed::get_heif_image_tiling()`. In a release/NDEBUG ASan build, the same file causes a null pointer read at address `0xa8`. Version 1.22.0 fixes the issue.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00183 · 7.4th percentile
Weakness
CWE-476 · NULL Pointer Dereference
Published
2026-07-21T21:31Z
EPSS history
Timeline
  • 21 JUL 21:31Z
    libheif has a NULL pointer dereference in heif_image_handle_get_image_tiling for malformed unci image missing ispe
    cvelistv5