CVE-2026-47247

High

Description

libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, two bugs in libheif chain to leak process heap memory as visible pixel values in decoded grid images. An attacker who uploads a crafted AVIF/HEIC file to any server-side image processor (WordPress, Sharp/libvips, ImageMagick, etc.) can recover heap data - including library function pointers sufficient to defeat ASLR, or any other secret - from the publicly-downloadable transcoded JPEG/PNG/WebP output. Local attack vectors are also possible. Version 1.22.0 fixes the issue.

SeverityHigh

CVSS7.5

Exploit probability—

ProductStruktur Libheif

PublishedJul 21, 2026

First seenJul 21, 2026

Weakness typeCWE-200Sensitive information exposure CWE-226CWE-226 CWE-682CWE-682 CWE-908CWE-908

How to fix

Update

struktur libheif1.22.0 or later

Affected products

Product	Affected versions	Fixed in
struktur libheif	v < 1.22.0	1.22.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.