libheif versions before 1.22.0 contain two vulnerabilities that together cause exposure of process heap memory through decoded grid images. An attacker can upload a crafted AVIF or HEIC file to a server-side image processing service (e.g., WordPress, Sharp/libvips, ImageMagick) and obtain sensitive heap data, including function pointers, from the output images (JPEG/PNG/WebP). This exposure can aid in defeating ASLR and reveal other secrets. The vulnerability is identified as CVE-2026-47247 with a CVSS 3.1 score of 7.5 (high severity). The issue is resolved in version 1.22.0 of libheif.

The vulnerability allows unauthorized disclosure of sensitive process heap memory, which can include library function pointers and other secrets. This information leakage can facilitate further attacks by bypassing memory protection mechanisms such as ASLR. The flaw affects any system using vulnerable libheif versions to decode AVIF/HEIC images, including popular server-side image processors. There is no indication of impact on integrity or availability, only confidentiality is affected.

Upgrade libheif to version 1.22.0 or later, where this vulnerability is fixed. Since no official patch or remediation level is explicitly stated beyond the version fix, applying this update is the recommended mitigation. No vendor advisory content contradicts this guidance. If upgrading immediately is not possible, restrict or validate AVIF/HEIC file uploads to affected image processing services to reduce exposure.