CVE-2026-47247

highCVSS 7.5covered by 1 sourcefirst seen 2026-07-21

libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, two bugs in libheif chain to leak process heap memory as visible pixel values in decoded grid images. An attacker who uploads a crafted AVIF/HEIC file to any server-side image processor (WordPress, Sharp/libvips, ImageMagick, etc.) can recover heap data - including library function pointers sufficient to defeat ASLR, or any other secret - from the publicly-downloadable transcoded JPEG/PNG/WebP output. Local attack vectors are also possible. Version 1.22.0 fixes the issue.

⚡ Watch CVE-2026-47247

Get an email if CVE-2026-47247 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Exploitation outlook

Low exploitation risk0.45% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 37% of all EPSS-scored CVEs.

Advisory coverage (1)

highCVE-2026-47247: libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, two bugs …nvd · 2026-07-21

External references

NVD record for CVE-2026-47247

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-47247 status](https://www.csirts.com/badge/CVE-2026-47247)](https://www.csirts.com/cve/CVE-2026-47247)