USN-8526-2: libheif vulnerabilities

unknownCVE-2026-47709 CVE-2026-47714

USN-8526-1 fixed vulnerabilities in libheif. This update provides the corresponding updates for CVE-2026-47709 and CVE-2026-47714 in Ubuntu 24.04 LTS. Original advisory details: Junyi Liu discovered that libheif had a null pointer dereference in its image tiling interface. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-47709) Calvin Young and Enoch Chow discovered that libheif had an integer overflow in its inline mask size calculation. An attacker could possibly use this issue to cause a denial of service or obtain sensitive information. (CVE-2026-47714)

CSIRTS triage

vendor: libheif product: libheif Denial of service Information disclosure

What: libheif has vulnerabilities that could lead to denial of service or information disclosure.
Who is affected: Deployments of libheif in Ubuntu 24.04 LTS are affected.
Urgency: Remediation is necessary due to potential denial of service and information exposure.
Action: Update to the latest version of libheif.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch libheif

Get an email when a new libheif advisory drops — max one per day, one-click unsubscribe.

Details

Source: Ubuntu Security Notices (INTL · vendor-psirt · site)
Severity: unknown
Published: 2026-07-14
Exploitation: Not in CISA KEV at last sync

Original advisory: https://ubuntu.com/security/notices/USN-8526-2

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-477090.21% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 12% of all scored CVEs.
Low exploitation riskCVE-2026-477140.11% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 1% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-47709	coverage & exploitation status	NVD · CVE.org
CVE-2026-47714	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.