CVE-2026-47709: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-47709 is a NULL pointer dereference vulnerability in the heif_image_handle_get_image_tiling function of libheif, a C/C++ library for decoding and encoding HEIF and AVIF image files. It affects libheif versions up to and including v1.21.2, and was patched in v1.22.0. The vulnerability was discovered by researcher Junyi Liu (credited as "mosskappa") and published by the libheif maintainers on May 19, 2026. It carries an estimated HIGH CVSS severity and an EPSS score of approximately 0.025% (GitHub Advisory, Ubuntu USN-8526-1).

The root cause is a missing null-pointer guard (CWE-476) in ImageItem_uncompressed::get_heif_image_tiling() within libheif/image-items/unc_image.cc. The function assumes both Box_ispe (image spatial extent) and Box_uncC (uncompressed codec configuration) properties are present for any uncompressed container (unci) image item, and asserts their existence via assert(ispe && uncC). In release/NDEBUG builds, this assertion is compiled out, so when a malformed HEIF file contains a uncC property but no ispe property, the code dereferences a null ispe pointer at offset 0xa8, causing a segmentation fault. An attacker can trigger this by supplying a crafted HEIF file to any application that calls the public C API heif_image_handle_get_image_tiling(). A proof-of-concept HEIF file and reproducer script are publicly available in the advisory (GitHub Advisory).

Successful exploitation causes a crash (denial of service) in any application that processes attacker-supplied HEIF input and calls heif_image_handle_get_image_tiling(). The maintainers and reporter confirm this is a DoS-only issue — there is no evidence of code execution, arbitrary memory read/write, or data exfiltration. Applications such as image viewers, media processors, and thumbnail generators that use libheif are at risk of being crashed by a malicious HEIF file (GitHub Advisory, Ubuntu USN-8526-1).

1. Craft malicious HEIF file: Create or use the published PoC HEIF file that contains a uncC (uncompressed codec) property associated with an image item but deliberately omits the required ispe (image spatial extent) property. The base64-encoded PoC is provided in the GitHub advisory.
2. Deliver the file: Supply the malformed poc.heif file to a target application that uses libheif and calls heif_image_handle_get_image_tiling() — for example, an image viewer, thumbnail generator, or media processing service.
3. Trigger the vulnerable code path: The application calls heif_context_read_from_file() to parse the file, then heif_context_get_primary_image_handle() to obtain the image handle, and finally heif_image_handle_get_image_tiling() to retrieve tiling information.
4. Achieve denial of service: In release builds, ImageItem_uncompressed::get_heif_image_tiling() dereferences the null ispe pointer at address 0xa8, causing a segmentation fault (SIGSEGV) and crashing the application (GitHub Advisory).

• Process: Application crash (SIGSEGV/segmentation fault) in a process using libheif, with a stack trace referencing ImageItem_uncompressed::get_heif_image_tiling(), heif_image_handle_get_image_tiling(), or related libheif functions.
• Logs: ASan output containing AddressSanitizer: SEGV on unknown address 0x0000000000a8 with a READ memory access cause, if the application is built with AddressSanitizer.
• File System: Presence of unexpected or externally supplied .heif files being processed by image handling services, particularly files with anomalously small sizes or malformed box structures.
• Network: Repeated delivery of HEIF files to image processing endpoints (e.g., upload APIs, thumbnail services) that result in service crashes or restarts (GitHub Advisory).

Upgrade libheif to version v1.22.0 or later, which includes a fix that guards against null ispe or uncC pointers before dereferencing them in get_heif_image_tiling(). Ubuntu users should update to the patched package versions: 1.21.2-3ubuntu0.3 (Ubuntu 26.04 LTS), 1.20.2-1ubuntu0.6 (Ubuntu 25.10), or 1.17.6-1ubuntu4.6 (Ubuntu 24.04 LTS). SUSE/openSUSE users should apply the updates referenced in SUSE-SU-2026:2622-1. As a workaround where patching is not immediately possible, restrict or sandbox applications that process untrusted HEIF files (GitHub Advisory, Ubuntu USN-8526-1, Ubuntu USN-8526-2).

The vulnerability was responsibly disclosed through GitHub's security advisory process by researcher Junyi Liu. Ubuntu and SUSE/openSUSE issued security updates promptly after the advisory was published, indicating standard vendor response. Coverage was noted in Linux security news outlets such as linuxsecurity.com and pro-linux.de. No significant broader media coverage or notable researcher commentary beyond the advisory itself has been observed (Ubuntu USN-8526-1, SUSE Advisory).