CVE-2026-47254: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-47254 is a heap buffer overflow vulnerability in libheif's Track::get_next_sample_raw_data() function caused by an out-of-bounds access of a chunk vector. It affects libheif versions up to and including 1.21.2, and was patched in v1.22.0. The vulnerability was discovered by Xianrui Dong (Niebelungen-D) and independently re-analyzed by m1-llie, with the advisory published on May 19, 2026 (GitHub Advisory). It is rated Moderate severity with an estimated HIGH CVSS category and an EPSS score of 0.024% (Feedly, GitHub Advisory).

The root cause (CWE-125: Out-of-bounds Read) lies in Track::init_sample_timing_table() in libheif/sequences/track.cc. When a crafted HEIC sequence file contains an stco box with fewer chunk offsets than the number of samples declared in stsz, the loop in init_sample_timing_table() increments current_chunk until it equals m_chunks.size(), but a > vs >= comparison error fails to catch this boundary condition, allowing the out-of-bounds index to be stored in m_presentation_timeline. A subsequent call to heif_track_get_next_raw_sequence_sample() then dereferences m_chunks[chunk_idx] at line 1087 with this OOB index, triggering a heap-buffer-overflow. A minimal 625-byte proof-of-concept HEIC file (with 5 samples in stsz but only 2 entries in stco) is included in the advisory and triggers the crash on the third call to heif_track_get_next_raw_sequence_sample() (GitHub Advisory).

Successful exploitation causes a denial of service (process crash) in any application that opens an attacker-controlled HEIC sequence file and iterates frames via heif_track_get_next_raw_sequence_sample(). Depending on heap layout, the OOB read may also expose adjacent heap memory contents, creating a potential information disclosure risk. Applications using heif_context_read_from_memory or heif_context_read_from_file with untrusted input are directly affected, including image viewers, thumbnailers, and media processing pipelines (GitHub Advisory, Ubuntu Advisory).

1. Craft malicious HEIC file: Create a minimal ISO BMFF HEIC sequence file where the stsz box declares more samples (e.g., 5) than the number of chunk offsets in the stco box (e.g., 2), with stsc set to 1 sample per chunk. This causes only 2 Chunk objects to be created while 5 samples are expected.
2. Deliver the file: Provide the crafted file to a target application that processes HEIC sequences — e.g., an image viewer, thumbnailer, or media pipeline — via file upload, email attachment, or network share.
3. Trigger parsing: The application calls heif_context_read_from_file() or heif_context_read_from_memory(), which invokes Track::load() and subsequently Track::init_sample_timing_table(). The OOB chunk index (m_chunks.size()) is stored in m_presentation_timeline for samples 2–4.
4. Trigger OOB read: The application iterates frames by calling heif_track_get_next_raw_sequence_sample(). On the third call, get_next_sample_raw_data() dereferences m_chunks[2] (OOB), causing a heap-buffer-overflow crash (DoS) and potentially leaking adjacent heap memory (GitHub Advisory).

• File System: Presence of malformed HEIC/HEIF sequence files with mismatched stsz sample counts and stco chunk offset counts; files with unusually small sizes (~625 bytes) claiming to be HEIC sequences.
• Process: Unexpected crashes or core dumps in applications using libheif (e.g., image viewers, thumbnailers, GNOME/KDE file managers); ASAN reports referencing Track::get_next_sample_raw_data() at track.cc:1087.
• Logs: Application crash logs or segfault entries in system logs (/var/log/syslog, journalctl) associated with HEIF file processing; error messages from libheif referencing sequence track parsing failures.

Upgrade libheif to version 1.22.0 or later, which contains the fix for this vulnerability (GitHub Advisory). Ubuntu users should update to the patched package versions: libheif1 1.21.2-3ubuntu0.3 on Ubuntu 26.04 LTS, or libheif1 1.20.2-1ubuntu0.6 on Ubuntu 25.10 (Ubuntu Advisory). SUSE users should apply the update referenced in SUSE-SU-2026:2622-1. As a workaround where patching is not immediately possible, restrict processing of untrusted HEIC sequence files and avoid exposing libheif-based applications to user-supplied media.

The vulnerability was addressed in Ubuntu Security Notice USN-8526-1 (July 9, 2026) alongside several other libheif issues, and SUSE issued a security update (SUSE-SU-2026:2622-1) (Ubuntu Advisory, SUSE Advisory). The openSUSE community also published a corresponding advisory. Coverage appeared in German Linux security outlet pro-linux.de. No notable social media discussion or high-profile researcher commentary beyond the original advisory has been identified.