CVE-2026-32738
published 2026-05-19CVE-2026-32738: libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and below, a crafted 792-byte HEIF sequence file with samples_per_chunk=0 in the…
PriorityP431medium6.5CVSS 3.1
AVNACLPRNUIRSUCNINAH
EPSS
0.30%
22.1th percentile
libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and below, a crafted 792-byte HEIF sequence file with samples_per_chunk=0 in the stsc box causes an unsigned integer underflow in the Chunk constructor (m_last_sample = 0 + 0 - 1 = UINT32_MAX), mapping all samples to an empty chunk and resulting in a denial of service. When any sample is accessed, the library reads from index 0 of an empty std::vector, causing a guaranteed SEGV (null-page read). The file parses successfully without producing an error; the crash occurs on the first frame access. This issue has been fixed in version 1.22.0.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| struktur | libheif | < 1.22.0 | 1.22.0 |
| strukturag | libheif | < 1.22.0 | 1.22.0 |
| ubuntu | libheif | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
vendor_redhat6.5MEDIUM
vendor_ubuntu6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
strukturag libheif up to 1.21.x out-of-bounds (GHSA-7f2h-cmpf-v9ww)
vuldb·2026-05-19·CVSS 6.5
CVE-2026-32738 [MEDIUM] strukturag libheif up to 1.21.x out-of-bounds (GHSA-7f2h-cmpf-v9ww)
A vulnerability was found in strukturag libheif up to 1.21.x and classified as problematic. This affects an unknown part. Such manipulation leads to out-of-bounds read.
This vulnerability is listed as CVE-2026-32738. The attack may be performed from remote. There is no available exploit.
It is suggested to upgrade the affected component.
Ubuntu
libheif vulnerabilities
vendor_ubuntu·2026-06-18·CVSS 6.5
CVE-2026-32740 [MEDIUM] libheif vulnerabilities
Title: libheif vulnerabilities
Summary: Several security issues were fixed in libheif.
Elhanan Haenel discovered that libheif incorrectly handled certain
malformed HEIF sequence files. An attacker could possibly use this
issue to cause a denial of service. This issue only affected Ubuntu 25.10
and Ubuntu 26.04 LTS. (CVE-2026-32738)
Elhanan Haenel discovered that libheif incorrectly handled certain
malformed HEIF sequence files, leading to an infinite loop. An attacker
could possibly use this issue to cause libheif to use excessive
resources, resulting in a denial of service. This issue only affected
Ubuntu 25.10 and Ubuntu 26.04 LTS. (CVE-2026-32739)
Elhanan Haenel discovered that libheif incorrectly handled certain
crafted HEIF/AVIF image files. An attacker could possibly use this iss
Red Hat
libheif: libheif: Unsigned integer underflow leads to Denial of Service
vendor_redhat·2026-05-19·CVSS 6.5
CVE-2026-32738 [MEDIUM] CWE-191 libheif: libheif: Unsigned integer underflow leads to Denial of Service
libheif: libheif: Unsigned integer underflow leads to Denial of Service
A flaw was found in libheif, a HEIF and AVIF file format decoder and encoder. A remote attacker could exploit this vulnerability by providing a specially crafted HEIF sequence file. This file, with `samples_per_chunk=0`, triggers an unsigned integer underflow, causing the library to map all samples to an empty chunk. When any sample is accessed, the library attempts to read from an invalid memory location, leading to a denial of service due to a guaranteed crash.
Package: glycin-loaders (Red Hat Enterprise Linux 10) - Not affected
No detection rules found.
No public exploits indexed.
2026-05-19
Published