CVE Watch21 jul 2026

CVE-2026-47714

libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, the inline mask parsing code in `libheif/region.cc

CVSS

6.1

Medio

EPSS

—

KEV

—

Exploit Today

0-100

Publicado: 21 jul 2026 · Última mod.: 21 jul 2026 · CWE-190

EPSS · 30d

Sin historial EPSS suficiente todavía.

Descripción técnica

libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, the inline mask parsing code in `libheif/region.cc` contains an integer overflow. Both `width` and `height` are `unsigned int` (32-bit) values parsed from the HEIF file. Their product can exceed `UINT32_MAX`, wrapping to a small value before the division by 8. This causes an undersized buffer allocation, leading to out-of-bounds memory access when the mask data is later interpreted as a `width x height` bitmap. Version 1.22.0 patches the issue.

Referencias oficiales

github.comhttps://github.com/strukturag/libheif/security/advisories/GHSA-h4wm-6wwf-qvhx

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-165172.9 BAJ

—

——0A signed integer overflow vulnerability was found in libarchive's ZIP writer. In the archive_write_zip_header function in archive_write_set_format_zip.c, when ZIP encryption is enabled and the entry file size is close to INT64_MAX, the addition of the encryption overhead to the entry size overflows int64_t, resulting in undefined behavior. This could lead to incorrect Zip64 extension decisions or potential memory corruption.2h CVE-2026-16416—

—

——0Integer overflow in Chromecast in Google Chrome prior to 150.0.7871.182 allowed a local attacker to potentially perform a sandbox escape via malicious network traffic. (Chromium security severity: High)3h CVE-2026-47251—

—

——0libheif is a HEIF and AVIF file format decoder and encoder. The fix for CVE-2026-3949 (commit `b97c8b5`, PR #1712) introduced an integer overflow in the very security check it added. The check itself can be bypassed, allowing a crafted HEIF file with a VVC track to trigger the same out-of-bounds heap read that CVE-2026-3949 was meant to prevent. This is a separate, currently-unpatched vulnerability. Issue #1712 was closed as fixed without testing the edge case where `size` is near `UINT32_MAX`. Version 1.22.0 patches the issue.4h CVE-2026-164089.8 CRÍ

—

——0Integer overflow in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 153.6h CVE-2026-163959.8 CRÍ

—

——0Integer overflow in the Audio/Video component. This vulnerability was fixed in Firefox 153.6h CVE-2026-415218.2 ALT

44.3%

——13xrdp is an open source RDP server. Versions 0.10.6 and prior contain an integer overflow vulnerability when processing screen update messages within the vnc-any connection mode. A malicious remote VNC server can send crafted image dimensions that cause an integer overflow during memory buffer size calculation, resulting in an undersized allocation. Subsequent processing of the incoming image data using the original oversized parameters leads to an out-of-bounds read. An unauthenticated remote attacker could exploit this flaw to disclose sensitive information from the heap memory or cause a denial of service (DoS) via a process crash. This issue has been fixed in version 0.10.6.1.7h