VulnSocial

CVE-2026-47251General(struktur / libheif)

LOWCVSS 6.1 · MEDIUM

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

libheif is a HEIF and AVIF file format decoder and encoder. The fix for CVE-2026-3949 (commit `b97c8b5`, PR #1712) introduced an integer overflow in the very security check it added. The check itself can be bypassed, allowing a crafted HEIF file with a VVC track to trigger the same out-of-bounds heap read that CVE-2026-3949 was meant to prevent. This is a separate, currently-unpatched vulnerability. Issue #1712 was closed as fixed without testing the edge case where `size` is near `UINT32_MAX`. Version 1.22.0 patches the issue.

struktur CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Exploit / PoC references
Other references
Weakness type (CWE)
CWE-125CWE-190

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • libheif

Threat summary

  • 2 mentions across 1 observed day

What's happening

  • Technical details provided in 2 signals
  • General: 2 classified signals
  • 2 total mentions across 1 day

Affected systems

Vendors
struktur
Products
libheif

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-07-21: 2Technical Details · 2026-07-21: 207-21
Signal classification1 categories
General
2100.0%
Referenced assets2 URLs
By indicator
Full discourse2 posts
  • Infoflowcloud@infoflowcloud
    General

    🚨*CVE* CVE-2026-47251 libheif is a HEIF and AVIF file format decoder and encoder. The fix for CVE-2026-3949 (commit `b97c8b5`, PR #1712) introduced an integer overflow in the very security… https://www.cve.org/CVERecord?id=CVE-2026-47251 ----- Traducción: CVE-2026-47251 lib… http://infoflow.cloud`

    Post summary

    A brief tweet references CVE‑2026‑47251 in libheif, noting that an integer overflow was introduced by a fix for a previous CVE, and links to the CVE record without providing PoC, exploit, or patch details.

    0000035
    94 followersView on X
  • CVE@CVEnew
    General

    CVE-2026-47251 libheif is a HEIF and AVIF file format decoder and encoder. The fix for CVE-2026-3949 (commit `b97c8b5`, PR #1712) introduced an integer overflow in the very security… https://www.cve.org/CVERecord?id=CVE-2026-47251

    Post summary

    The message references CVE‑2026‑47251, noting an integer overflow in libheif introduced by a prior patch, but offers no evidence of exploitation, PoC, or mitigation steps.

    000001.1K
    57.8K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appstrukturlibheif---

Explore more

Back to dashboardstruktur CVEslibheif vulnerabilities