CVE-2026-32740
published 2026-05-19CVE-2026-32740: libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.21.2 and prior contain a heap-buffer-overflow (write) vulnerability in the grid tile…
PriorityP352high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
EPSS
0.76%
54.8th percentile
libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.21.2 and prior contain a heap-buffer-overflow (write) vulnerability in the grid tile compositing, allowing an attacker to write 64 bytes of fully attacker-controlled data past the end of a chroma plane heap allocation by crafting a HEIF/AVIF file with a 1×4 grid of odd-height tiles. The overflow is triggered during normal image decoding with default build configuration. The written bytes are chroma (Cb/Cr) pixel values from the attacking tile, giving the attacker full control over the overflow content. This issue has been fixed in version 1.22.0.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| struktur | libheif | < 1.22.0 | 1.22.0 |
| strukturag | libheif | < 1.22.0 | 1.22.0 |
| ubuntu | libheif | — | — |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
vendor_redhat8.8HIGH
vendor_ubuntu6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
libheif vulnerabilities
vendor_ubuntu·2026-06-18·CVSS 6.5
CVE-2026-32740 [MEDIUM] libheif vulnerabilities
Title: libheif vulnerabilities
Summary: Several security issues were fixed in libheif.
Elhanan Haenel discovered that libheif incorrectly handled certain
malformed HEIF sequence files. An attacker could possibly use this
issue to cause a denial of service. This issue only affected Ubuntu 25.10
and Ubuntu 26.04 LTS. (CVE-2026-32738)
Elhanan Haenel discovered that libheif incorrectly handled certain
malformed HEIF sequence files, leading to an infinite loop. An attacker
could possibly use this issue to cause libheif to use excessive
resources, resulting in a denial of service. This issue only affected
Ubuntu 25.10 and Ubuntu 26.04 LTS. (CVE-2026-32739)
Elhanan Haenel discovered that libheif incorrectly handled certain
crafted HEIF/AVIF image files. An attacker could possibly use this iss
Red Hat
libheif: libheif: Arbitrary code execution or denial of service via crafted HEIF/AVIF file
vendor_redhat·2026-05-19·CVSS 8.8
CVE-2026-32740 [HIGH] CWE-787 libheif: libheif: Arbitrary code execution or denial of service via crafted HEIF/AVIF file
libheif: libheif: Arbitrary code execution or denial of service via crafted HEIF/AVIF file
A flaw was found in libheif, a library for decoding and encoding HEIF and AVIF image files. This heap-buffer-overflow vulnerability allows a remote attacker to write arbitrary data beyond the intended memory boundary. By crafting a malicious HEIF/AVIF file with a specific grid tile configuration, an attacker could potentially achieve arbitrary code execution or cause a denial of service.
Package: glycin-loaders (Red Hat Enterprise Linux 10) - Not affected
VulDB
strukturag libheif up to 1.21.x AVIF File out-of-bounds write (GHSA-frfr-f3vg-2g6j)
vuldb·2026-05-19·CVSS 8.8
CVE-2026-32740 [HIGH] strukturag libheif up to 1.21.x AVIF File out-of-bounds write (GHSA-frfr-f3vg-2g6j)
A vulnerability was found in strukturag libheif up to 1.21.x. It has been rated as critical. Impacted is an unknown function of the component AVIF File Handler. The manipulation leads to out-of-bounds write.
This vulnerability is documented as CVE-2026-32740. The attack can be initiated remotely. There is not any exploit available.
Upgrading the affected component is advised.
No detection rules found.
No public exploits indexed.
Bugzilla
libheif F43/F44 remain on vulnerable upstream versions despite existing Red Hat Product Security trackers
bugzilla·2026-09-18·CVSS 8.8
CVE-2026-32740 [HIGH] libheif F43/F44 remain on vulnerable upstream versions despite existing Red Hat Product Security trackers
libheif F43/F44 remain on vulnerable upstream versions despite existing Red Hat Product Security trackers
The Fedora 43 and Fedora 44 `libheif` packages appear to be behind multiple upstream security fixes that are already being tracked by Red Hat Product Security.
Current Fedora packages:
* Fedora 43: `libheif-1.20.2-6.fc43`
* Fedora 44: `libheif-1.21.2-1.fc44`
Multiple Red Hat Product Security trackers explicitly identify versions including Fedora's current 1.20.x/1.21.2 packages as affected.
Examples include:
* CVE-2026-32740 — Red Hat Bug 2479969
Affects `libheif` 1.21.2 and earlier; upstream fix in 1.22.0.
* CVE-2026-32741 — Red Hat Bug 2480002
Affects versions through 1.21.2; upstream fix in 1.22.0.
* CVE-2026-32814 — Red Hat Bug 2480001
Affects versions through 1.21.2; upstr
Bugzilla
CVE-2026-32740 libheif: libheif: Arbitrary code execution or denial of service via crafted HEIF/AVIF file
bugzilla·2026-05-19·CVSS 8.8
CVE-2026-32740 [HIGH] CVE-2026-32740 libheif: libheif: Arbitrary code execution or denial of service via crafted HEIF/AVIF file
CVE-2026-32740 libheif: libheif: Arbitrary code execution or denial of service via crafted HEIF/AVIF file
libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.21.2 and prior contain a heap-buffer-overflow (write) vulnerability in the grid tile compositing, allowing an attacker to write 64 bytes of fully attacker-controlled data past the end of a chroma plane heap allocation by crafting a HEIF/AVIF file with a 1×4 grid of odd-height tiles. The overflow is triggered during normal image decoding with default build configuration. The written bytes are chroma (Cb/Cr) pixel values from the attacking tile, giving the attacker full control over the overflow content. This issue has been fixed in version 1.22.0.
Hackernews
⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More
blogs_hackernews·2026-10-12·CVSS 9.3
CVE-2026-21589 [CRITICAL] ⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More
Some meetings last longer than it took attackers to jump on a newly disclosed security flaw this week. Within hours, they were already testing it. That's not much time to read the warning, let alone do something about it.
But speed is only part of the problem. A secure connection didn't always mean a safe destination. People offering to fix a ransomware mess had questions to answer themselves. Malware got better at hiding its tracks. And some systems turned out to be easier to break into than anyone would like to admit. The odd par
https://github.com/strukturag/libheif/releases/tag/v1.22.0https://github.com/strukturag/libheif/security/advisories/GHSA-frfr-f3vg-2g6jhttps://access.redhat.com/security/cve/CVE-2026-32740https://bugzilla.redhat.com/show_bug.cgi?id=2479969https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32740.json
2026-05-19
Published