CVE-2026-47251: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-47251 is an integer overflow vulnerability in the vvdec_push_data2 function of libheif that bypasses a security check introduced to fix CVE-2026-3949, allowing a crafted HEIF file with a VVC track to trigger an out-of-bounds heap read. It affects libheif versions from commit b97c8b5 (2026-02-23) through v1.21.2 (inclusive), specifically when built with VVC support (-DWITH_VVDEC=ON). The vulnerability was published on May 19, 2026, by the libheif maintainer (farindk) via a GitHub Security Advisory. It carries a CVSS v4 base score of 6.8 (Moderate) (GitHub Advisory).

The root cause is an integer overflow (CWE-190) in libheif/plugins/decoder_vvdec.cc that leads to an out-of-bounds read (CWE-125). The security check added by the CVE-2026-3949 fix evaluates frame_size < 4 + size, where size is a uint32_t and 4 is an int; when size is near UINT32_MAX (e.g., 0xFFFFFFFD), the addition wraps around to a small value, causing the bounds check to pass incorrectly. A subsequent nalu.insert(nalu.end(), data, data + size) then attempts to read approximately 4 GB of data past the end of the frame buffer. The same overflow also exists in the frame_size -= 4 + size decrement on line 212. Exploitation requires a user or application to open a specially crafted HEIF file containing a VVC item with a length prefix near UINT32_MAX (GitHub Advisory).

Successful exploitation causes a process crash (denial of service) as the out-of-bounds read of ~4 GB typically faults before completing. There is also a limited risk of information disclosure, as heap layout may permit reading adjacent heap allocations before the fault occurs. Any application linking libheif with VVC support that processes user-supplied HEIF files is affected, including image viewers, media processors, and web services that handle HEIF/VVC content (GitHub Advisory).

1. Craft malicious HEIF file: Create a valid HEIF container (ftyp/meta/iloc/iprp with ispe and minimal vvcC box) containing a single VVC item whose mdat data begins with the 4-byte length prefix FF FF FF FD (size = UINT32_MAX - 2 = 0xFFFFFFFD), followed by arbitrary padding bytes (e.g., 60 zero bytes). A working 322-byte PoC is provided in the advisory.
2. Deliver the file to the target: Send the crafted .heif file to a victim via email attachment, web upload, or any other file-sharing mechanism that causes the target application to process it.
3. Trigger decoding: The victim opens the file with an application linked against libheif built with -DWITH_VVDEC=ON (e.g., heif-dec poc3.heif out.png).
4. Integer overflow bypasses bounds check: In vvdec_push_data2, the check frame_size < 4 + size wraps to frame_size < 1 due to uint32_t overflow, which evaluates as false for any non-empty buffer, bypassing the security guard.
5. Out-of-bounds heap read: nalu.insert(nalu.end(), data, data + size) attempts to read ~4 GB from the frame buffer, causing a heap-buffer-overflow that crashes the process (DoS) and may expose adjacent heap memory contents (GitHub Advisory).

• File System: Presence of unexpected .heif files with VVC content (vvc1 or vvcC box markers) and mdat payloads starting with bytes FF FF FF FD or similar near-UINT32_MAX length prefixes.
• Process: Application crashes (segmentation fault or AddressSanitizer heap-buffer-overflow) in processes linked against libheif, specifically in stack frames referencing vvdec_push_data2 (decoder_vvdec.cc), Decoder::decode_sequence_frame_from_compressed_data, or heif_decode_image.
• Logs: Crash reports or core dumps from image-processing applications showing READ of size 4294967293 or similar large read sizes; ASan output referencing vector::insert and vvdec_push_data2 (GitHub Advisory).

Upgrade libheif to version v1.22.0 or later, which contains the fix replacing the overflow-prone 4 + size comparison with the safe size > frame_size - 4 check. As a workaround, disable VVC decoder support by building libheif without -DWITH_VVDEC=ON if VVC decoding is not required. SUSE has released updated packages (SUSE-SU-2026:2622-1) and openSUSE has issued a corresponding security update for affected distributions (GitHub Advisory, SUSE Advisory).

The vulnerability was discovered using a commercial static analysis and fuzzing tool called hyperanalyzer (private beta), with Rule V8004 flagging the vulnerable function; the reporter (gb1dev) performed manual review to confirm the integer overflow. The Solus Linux community noted the issue in their weekly security digest. SUSE and openSUSE promptly issued security advisories and updated packages, and Tenable published Nessus detection plugins (IDs 323098 and 324785) for the vulnerability (SUSE Advisory, Tenable).