Skip to main content

libheif CVE-2026-32740

| EUVDEUVD-2026-30978 HIGH
Out-of-bounds Write (CWE-787)
2026-05-19 GitHub_M
Memory Corruption Buffer Overflow Libheif
8.8
CVSS 3.1 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
8.8 HIGH
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
SUSE
HIGH
qualitative
Red Hat
8.8 HIGH
qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

3
Source Code Evidence Fetched
May 19, 2026 - 20:15 vuln.today
Analysis Generated
May 19, 2026 - 20:15 vuln.today
Patch available
May 19, 2026 - 20:02 EUVD

DescriptionCVE.org

libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.21.2 and prior contain a heap-buffer-overflow (write) vulnerability in the grid tile compositing, allowing an attacker to write 64 bytes of fully attacker-controlled data past the end of a chroma plane heap allocation by crafting a HEIF/AVIF file with a 1×4 grid of odd-height tiles. The overflow is triggered during normal image decoding with default build configuration. The written bytes are chroma (Cb/Cr) pixel values from the attacking tile, giving the attacker full control over the overflow content. This issue has been fixed in version 1.22.0.

AnalysisAI

Heap buffer overflow write in libheif (versions ≤ 1.21.2) lets a crafted HEIF/AVIF file write 64 bytes of attacker-controlled data past a chroma-plane heap allocation during grid tile compositing. Any application using libheif to decode untrusted images - image viewers, file managers, browsers, mobile OS thumbnailers - is exposed, with CVSS 8.8 reflecting likely code execution after user-triggered file open. No public exploit identified at time of analysis, but the deterministic 64-byte fully-controlled overflow is highly favorable for exploitation.

Technical ContextAI

libheif is the dominant open-source HEIF/AVIF encoder/decoder maintained by struktur AG (CPE cpe:2.3:a:strukturag:libheif), embedded in GIMP, ImageMagick, GNOME/KDE thumbnailers, Nextcloud preview generators, and many distro image pipelines. The bug is a CWE-787 out-of-bounds write in the grid tile compositor: when reassembling a 1×4 grid of odd-height tiles, the chroma (Cb/Cr) plane allocation is undersized relative to the per-tile copy loop, so 64 bytes of chroma pixel data from the final tile spill past the heap allocation. Because the overflow content is raw chroma pixel values copied verbatim from the attacker's tile, the attacker chooses every byte of the overflow - a strong primitive against adjacent heap metadata or function pointers.

RemediationAI

Vendor-released patch: upgrade libheif to 1.22.0 or later (release https://github.com/strukturag/libheif/releases/tag/v1.22.0, advisory https://github.com/strukturag/libheif/security/advisories/GHSA-frfr-f3vg-2g6j); rebuild or repackage any application that statically links libheif and ensure distro packages (Debian, Ubuntu, RHEL, Alpine, Homebrew) are refreshed since most software loads the system shared library. Where immediate upgrade is impossible, disable HEIF/AVIF handlers in thumbnailers and mail/chat clients (e.g., remove the heif mime association or unregister gdk-pixbuf/QtImageFormats HEIF plugins) and block .heic/.heif/.avif at email and web proxies - trade-off is loss of legitimate HEIC preview, which is common on iPhone-sourced images. Sandboxing the decoder process (bubblewrap, seccomp, AppArmor) reduces blast radius but does not prevent the corruption itself.

More in Libheif

View all
CVE-2023-49464 HIGH POC
8.8 Dec 07

libheif v1.17.5 was discovered to contain a segmentation violation via the function UncompressedImageCodec::get_luma_bit
CVE-2023-49463 HIGH POC
8.8 Dec 07

libheif v1.17.5 was discovered to contain a segmentation violation via the function find_exif_tag at /libheif/exif.cc. R
CVE-2023-49462 HIGH POC
8.8 Dec 07

libheif v1.17.5 was discovered to contain a segmentation violation via the component /libheif/exif.cc. Rated high severi
CVE-2023-49460 HIGH POC
8.8 Dec 07

libheif v1.17.5 was discovered to contain a segmentation violation via the function UncompressedImageCodec::decode_uncom
CVE-2019-11471 HIGH POC
8.8 Apr 23

libheif 1.4.0 has a use-after-free in heif::HeifContext::Image::set_alpha_channel in heif_context.h because heif_context
CVE-2024-41311 HIGH POC
8.1 Oct 15

In Libheif 1.17.6, insufficient checks in ImageOverlay::parse() decoding a heif file containing an overlay image with fo
CVE-2024-25269 HIGH POC
7.5 Mar 05

libheif <= 1.17.6 contains a memory leak in the function JpegEncoder::Encode. Rated high severity (CVSS 7.5), this vulne
CVE-2023-29659 MEDIUM POC
6.5 May 05

A Segmentation fault caused by a floating point exception exists in libheif 1.15.1 using crafted heif images via the hei
CVE-2025-29482 MEDIUM POC
6.2 Apr 07

Buffer Overflow vulnerability in libheif 1.19.7 allows a local attacker to execute arbitrary code via the SAO (Sample Ad
CVE-2023-0996 HIGH
7.8 Feb 24

There is a vulnerability in the strided image data parsing code in the emscripten wrapper for libheif. Rated high severi
CVE-2026-32741 HIGH
7.1 May 19

Heap buffer overflow in libheif versions 1.21.2 and below allows remote attackers to corrupt memory via a maliciously cr
CVE-2026-32882 HIGH
7.1 May 19

Heap buffer over-read in libheif versions 1.21.2 and prior allows remote attackers to crash applications or potentially

Same weakness CWE-787 – Out-of-bounds Write

View all
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2012-1889 HIGH POC
8.8
CVE-2010-3333 HIGH POC
7.8
CVE-2014-1761 HIGH POC
7.8
CVE-2009-3129 HIGH POC
7.8
CVE-2021-1732 HIGH POC
7.8
CVE-2013-3346 CRITICAL POC
9.8

Same technique Memory Corruption

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2010-3333 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP7 Fixed

Share

CVE-2026-32740 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy