CVE-2026-48029

HIGH 7.1CVE-2026-48029 · Published 22/07/2026 · updated 24/10/2026

In short

CVE-2026-48029 is a HIGH (CVSS 7.1) vulnerability affecting libheif (struktur).
Chance of exploitation in the next 30 days (EPSS): 0.36%, higher than 29.7% of all vulnerabilities.
Fix: update to 1.22.0 or later.

Package	Affected versions	Patched versions
libheif struktur	`≥ 1.19.0, < 1.22.0`	`1.22.0`

Description

libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.19.0 through 1.21.2 have a heap OOB read in ImageItem_Grid::decode_grid_tile via irot-induced tile-coordinate underflow. Version 1.22.0 fixes the issue.

References

strukturag/libheif commit e523ec0 · Patch
strukturag/libheif security advisory · Mitigation

More vulnerabilities in libheif

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

libheif

struktur

≥ 1.19.0, < 1.22.0

1.22.0

More vulnerabilities in libheif

See all →