{"id":"DEBIAN-CVE-2026-47254","details":"libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, `Track::init_sample_timing_table()` in `libheif/sequences/track.cc` stores an out-of-bounds chunk index (`m_chunks.size()`) into `m_presentation_timeline` when the number of chunks defined in the `stco` box is less than the number of samples in `stsz`. A subsequent call to `heif_track_get_next_raw_sequence_sample()` reads `m_chunks[chunk_idx]` with that OOB index, causing a heap-buffer-overflow. Version 1.22.0 fixes the issue.","modified":"2026-09-01T16:06:47.313648571Z","published":"2026-07-21T22:17:12.957Z","upstream":["CVE-2026-47254"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2026-47254"}],"affected":[{"package":{"name":"libheif","ecosystem":"Debian:12","purl":"pkg:deb/debian/libheif?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.15.1-1","1.15.1-1+deb12u1","1.16.2-1","1.16.2-2","1.16.2-3","1.17.0-1","1.17.1-1","1.17.4-1","1.17.6-1","1.17.6-2","1.17.6-3","1.17.6-4","1.18.1-1","1.18.1-2","1.18.2-1","1.18.2-2","1.19.1-1","1.19.1-1~bpo12+1","1.19.1-1~bpo12+2","1.19.3-1","1.19.3-1~bpo12+1","1.19.5-1","1.19.7-1","1.19.7-1~bpo12+1","1.19.8-1","1.20.1-1","1.20.2-1","1.20.2-2","1.21.2-1","1.21.2-2","1.21.2-3","1.21.2-4","1.23.1-1","1.23.2-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-47254.json"}},{"package":{"name":"libheif","ecosystem":"Debian:14","purl":"pkg:deb/debian/libheif?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.1-1"}]}],"versions":["1.19.8-1","1.20.1-1","1.20.2-1","1.20.2-2","1.21.2-1","1.21.2-2","1.21.2-3","1.21.2-4"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-47254.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H"}]}