CVE-2026-47709

Katalog CVE

CVSS 5.5 · Medium EPSS 0,18%

Kerentanan NULL Pointer Dereference pada struktur libheif. Skor CVSS 3.1 5.5 (Medium) menurut NVD.

Deskripsi (NVD)

libheif is a HEIF and AVIF file format decoder and encoder. Versions prior to 1.22.0 crashes in the public C API `heif_image_handle_get_image_tiling()` when a malformed uncompressed HEIF image item has an associated `uncC` property but no associated `ispe` property. In debug builds this trips the `ispe && uncC` assertion in `ImageItem_uncompressed::get_heif_image_tiling()`. In a release/NDEBUG ASan build, the same file causes a null pointer read at address `0xa8`. Version 1.22.0 fixes the issue.

Rincian

Terbit di NVD

21 Juli 2026

Terakhir diubah

27 Juli 2026

Status NVD

Analyzed

CVSS 3.1

5.5 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-476: NULL Pointer Dereference

EPSS (30 hari)

0,18% peluang dieksploitasi; lebih tinggi dari 7,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/strukturag/libheif/security/advisories/GHSA-4h72-vqgp-9376 exploit · advisory vendor · mitigasi
• https://github.com/strukturag/libheif/pull/1806 exploit · issue tracking · patch · advisory pihak ketiga
• https://github.com/strukturag/libheif/issues/1802 exploit · issue tracking · advisory pihak ketiga