Skip to main content

libheif CVE-2026-32738

| EUVDEUVD-2026-30972 MEDIUM
Out-of-bounds Read (CWE-125)
2026-05-19 GitHub_M
Buffer Overflow Denial Of Service Information Disclosure Libheif Strukturag
6.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
SUSE
MEDIUM
qualitative
Red Hat
6.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

2
Patch available
May 19, 2026 - 20:02 EUVD
Analysis Generated
May 19, 2026 - 19:31 vuln.today

DescriptionNVD

libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and below, a crafted 792-byte HEIF sequence file with samples_per_chunk=0 in the stsc box causes an unsigned integer underflow in the Chunk constructor (m_last_sample = 0 + 0 - 1 = UINT32_MAX), mapping all samples to an empty chunk and resulting in a denial of service. When any sample is accessed, the library reads from index 0 of an empty std::vector, causing a guaranteed SEGV (null-page read). The file parses successfully without producing an error; the crash occurs on the first frame access. This issue has been fixed in version 1.22.0.

AnalysisAI

Denial of service in libheif versions 1.21.2 and below allows a remote attacker to crash any application linked against the library by supplying a crafted HEIF sequence file. The crash is deterministic - the malformed file passes parsing without error, then triggers a guaranteed SEGV on the first frame access due to an unsigned integer underflow that maps all media samples to an empty chunk. No public exploit has been identified at time of analysis, and this is not listed in the CISA KEV catalog; vendor-released patch is available in version 1.22.0.

Technical ContextAI

libheif (by strukturag, CPE cpe:2.3:a:strukturag:libheif:*:*:*:*:*:*:*:*) is an open-source C++ library for decoding and encoding HEIF and AVIF image formats built on the ISOBMFF container standard. Within ISOBMFF, the stsc (sample-to-chunk) box maps media samples to storage chunks using fields including first_chunk, samples_per_chunk, and sample_description_index. When samples_per_chunk is zero in a crafted file, the Chunk constructor computes m_last_sample as first_sample + sample_count - 1, which evaluates to 0 + 0 - 1 = UINT32_MAX due to unsigned 32-bit integer underflow - a classic CWE-125 (Out-of-Bounds Read) root cause. This corrupted chunk descriptor maps all samples in the track to an empty chunk. Because the file passes initial parsing successfully, the crash is deferred until the first frame access, at which point the library reads index 0 from an empty std::vector, producing a SEGV via null-page dereference. The attack surface is any code path that calls libheif to decode a user-supplied HEIF sequence file.

RemediationAI

Upgrade libheif to version 1.22.0, which resolves the unsigned integer underflow in the Chunk constructor; this is the vendor-released patch confirmed by the GitHub Security Advisory GHSA-7f2h-cmpf-v9ww at https://github.com/strukturag/libheif/security/advisories/GHSA-7f2h-cmpf-v9ww. For deployments where an immediate upgrade is not feasible, implement input validation to reject HEIF/AVIF files with stsc boxes containing samples_per_chunk=0 before passing content to libheif - this blocks the specific malformed file pattern at the cost of adding a preprocessing dependency. For server-side pipelines that automatically process untrusted uploads, sandboxing the libheif decoding process (e.g., via a short-lived subprocess or seccomp-restricted container) will contain crash impact to a single worker rather than the parent service, preserving availability. Note that sandboxing does not fix the vulnerability but limits blast radius. Package maintainers distributing libheif as a shared library (e.g., via apt, dnf, or Homebrew) should track when 1.22.0 reaches their distribution's repositories.

More in Libheif

View all
CVE-2023-49464 HIGH POC
8.8 Dec 07

libheif v1.17.5 was discovered to contain a segmentation violation via the function UncompressedImageCodec::get_luma_bit
CVE-2023-49463 HIGH POC
8.8 Dec 07

libheif v1.17.5 was discovered to contain a segmentation violation via the function find_exif_tag at /libheif/exif.cc. R
CVE-2023-49462 HIGH POC
8.8 Dec 07

libheif v1.17.5 was discovered to contain a segmentation violation via the component /libheif/exif.cc. Rated high severi
CVE-2023-49460 HIGH POC
8.8 Dec 07

libheif v1.17.5 was discovered to contain a segmentation violation via the function UncompressedImageCodec::decode_uncom
CVE-2019-11471 HIGH POC
8.8 Apr 23

libheif 1.4.0 has a use-after-free in heif::HeifContext::Image::set_alpha_channel in heif_context.h because heif_context
CVE-2024-41311 HIGH POC
8.1 Oct 15

In Libheif 1.17.6, insufficient checks in ImageOverlay::parse() decoding a heif file containing an overlay image with fo
CVE-2024-25269 HIGH POC
7.5 Mar 05

libheif <= 1.17.6 contains a memory leak in the function JpegEncoder::Encode. Rated high severity (CVSS 7.5), this vulne
CVE-2023-29659 MEDIUM POC
6.5 May 05

A Segmentation fault caused by a floating point exception exists in libheif 1.15.1 using crafted heif images via the hei
CVE-2025-29482 MEDIUM POC
6.2 Apr 07

Buffer Overflow vulnerability in libheif 1.19.7 allows a local attacker to execute arbitrary code via the SAO (Sample Ad
CVE-2026-32740 HIGH
8.8 May 19

Heap buffer overflow write in libheif (versions ≤ 1.21.2) lets a crafted HEIF/AVIF file write 64 bytes of attacker-contr
CVE-2026-47178 HIGH
7.8 Jul 21

Arbitrary code execution in libheif 1.19.0 through 1.21.2 via a crafted HEIF file with uncompressed, tiled, component-in
CVE-2023-0996 HIGH
7.8 Feb 24

There is a vulnerability in the strided image data parsing code in the emscripten wrapper for libheif. Rated high severi

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP7 Fixed

Share

CVE-2026-32738 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy