CVE-2026-32741
published 2026-05-19CVE-2026-32741: libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.21.2 and below contain a heap buffer overflow in MaskImageCodec::decode_mask_image()…
PriorityP338high7.1CVSS 3.1
AVNACLPRNUIRSUCNILAH
EPSS
0.34%
26.6th percentile
libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.21.2 and below contain a heap buffer overflow in MaskImageCodec::decode_mask_image(). When decoding a HEIF file containing a mask image (mski), the function copies the full iloc extent data into a pixel buffer using memcpy(dst, data.data(), data.size()). The copy length data.size() is determined by the iloc extent in the file (attacker-controlled), while the destination buffer is sized based on the declared image dimensions. Because no upper-bound check exists on the data length, a crafted file whose iloc extent exceeds the pixel buffer allocation overflows the heap. The vulnerable single-memcpy branch is reached when the mskC property specifies bits_per_pixel = 8 and the ispe property declares an even width ≥ 64 (so that stride == width), with no changes to default security limits or external codec plugins required. This issue has been fixed in version 1.22.0.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| strukturag | libheif | < 1.22.0 | 1.22.0 |
| ubuntu | libheif | — | — |
CVSS provenance
nvdv3.17.1HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
vendor_redhat7.1HIGH
vendor_ubuntu6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
libheif vulnerabilities
vendor_ubuntu·2026-06-18·CVSS 6.5
CVE-2026-32740 [MEDIUM] libheif vulnerabilities
Title: libheif vulnerabilities
Summary: Several security issues were fixed in libheif.
Elhanan Haenel discovered that libheif incorrectly handled certain
malformed HEIF sequence files. An attacker could possibly use this
issue to cause a denial of service. This issue only affected Ubuntu 25.10
and Ubuntu 26.04 LTS. (CVE-2026-32738)
Elhanan Haenel discovered that libheif incorrectly handled certain
malformed HEIF sequence files, leading to an infinite loop. An attacker
could possibly use this issue to cause libheif to use excessive
resources, resulting in a denial of service. This issue only affected
Ubuntu 25.10 and Ubuntu 26.04 LTS. (CVE-2026-32739)
Elhanan Haenel discovered that libheif incorrectly handled certain
crafted HEIF/AVIF image files. An attacker could possibly use this iss
Red Hat
libheif: libheif: Heap buffer overflow vulnerability in image decoding
vendor_redhat·2026-05-19·CVSS 7.1
CVE-2026-32741 [HIGH] CWE-120 libheif: libheif: Heap buffer overflow vulnerability in image decoding
libheif: libheif: Heap buffer overflow vulnerability in image decoding
A flaw was found in libheif, a library for decoding and encoding HEIF (High Efficiency Image File Format) and AVIF files. A remote attacker could exploit a heap buffer overflow vulnerability in the MaskImageCodec::decode_mask_image() function by providing a specially crafted HEIF file containing a mask image. This vulnerability occurs because the function copies image data into a buffer without proper size validation, allowing the attacker-controlled input to exceed the allocated memory. Successful exploitation can lead to a denial of service (DoS) and potentially other impacts due to memory corruption.
Package: glycin-loaders (Red Hat Enterprise Linux 10) - Not affected
VulDB
strukturag libheif up to 1.21.x AVIF File decode_mask_image heap-based overflow
vuldb·2026-05-19·CVSS 7.1
CVE-2026-32741 [HIGH] strukturag libheif up to 1.21.x AVIF File decode_mask_image heap-based overflow
A vulnerability classified as critical has been found in strukturag libheif up to 1.21.x. Affected by this vulnerability is the function MaskImageCodec::decode_mask_image of the component AVIF File Handler. The manipulation leads to heap-based buffer overflow.
This vulnerability is uniquely identified as CVE-2026-32741. The attack is possible to be carried out remotely. No exploit exists.
It is recommended to upgrade the affected component.
No detection rules found.
No public exploits indexed.
https://github.com/strukturag/libheif/releases/tag/v1.22.0https://github.com/strukturag/libheif/security/advisories/GHSA-j3w5-7whq-p37qhttps://access.redhat.com/security/cve/CVE-2026-32741https://bugzilla.redhat.com/show_bug.cgi?id=2480002https://github.com/strukturag/libheif/security/advisories/GHSA-j3w5-7whq-p37qhttps://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32741.json
2026-05-19
Published