Detections
Analytics

Echo: libheif: security update to 1.19.8-1+e6

high Tenable Self-Hosted Container Security Plugin ID 462331

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, two bugs in libheif
 chain to leak process heap memory as visible pixel values in decoded grid images. An attacker who uploads
 a crafted AVIF/HEIC file to any server-side image processor (WordPress, Sharp/libvips, ImageMagick, etc.)
 can recover heap data - including library function pointers sufficient to defeat ASLR, or any other secret
 - from the publicly-downloadable transcoded JPEG/PNG/WebP output. Local attack vectors are also possible.
 Version 1.22.0 fixes the issue. (CVE-2026-47247)

Solution

Update the libheif library and its related packages to version 1.19.8-1+e6 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-47247

Plugin Details

Severity: High

ID: 462331

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.73

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.1

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N

CVSS Score Source: CVE-2026-47247

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 7/2/2026

Vulnerability Publication Date: 7/20/2026

Reference Information

CVE: CVE-2026-47247