CVE-2026-47178 is a heap out-of-bounds write vulnerability (CWE-787) in the strukturag libheif library, affecting versions 1.19.0 through 1.21.2. The flaw occurs in the uncompressed tile decoder when handling a crafted HEIF file using the uncompressed `unci` codec with tiled, component-interleaved 4:2:0 format. The out-of-bounds write overwrites the vtable pointer of an adjacent `unc_decoder_component_interleave` C++ object, causing subsequent virtual function calls to dispatch to an attacker-controlled address. This can lead to code execution or application crash. The vulnerability is patched in libheif version 1.22.0.

Successful exploitation can result in a heap out-of-bounds write that overwrites a C++ vtable pointer, enabling potential arbitrary code execution or denial of service via application crash. The CVSS 3.1 base score is 6.1 (medium severity), reflecting local attack vector with low complexity, no privileges required, user interaction needed, and impact primarily on availability and limited confidentiality impact.

Upgrade libheif to version 1.22.0 or later, where this vulnerability is patched. No other official remediation or temporary fixes are indicated. Users should avoid processing untrusted HEIF files with affected versions until patched.