libheif CVE-2026-32741

Exploitation requires the victim to process (open, preview, thumbnail, or convert) an attacker-supplied HEIF file using libheif ≤ 1.21.2; the file must contain a mask image item whose mskC property sets bits_per_pixel=8 and whose ispe property declares an even width ≥ 64 so the stride==width fast path is taken, with an iloc extent size larger than the derived pixel buffer. Per the advisory, no changes to libheif's default security limits and no external codec plugins are needed, so a default-configured deployment is vulnerable. Limiting factors per the CVSS vector (UI:R): user or automated interaction with the file is required - purely passive network presence does not trigger the bug - and no authentication to libheif itself is involved since it is a library, so risk scales with how aggressively the host application auto-decodes untrusted imagery.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H (7.1, High) captures the realistic exposure: the file can be delivered remotely, attack complexity is low, no privileges are required, but user interaction (opening or processing the file) is needed, and the documented impact is high availability loss with limited integrity impact (no confidentiality). Heap corruption of this shape is plausibly upgradable to code execution depending on the host allocator and surrounding objects, but the CVSS authors conservatively rated C:N, suggesting RCE is not yet demonstrated. No EPSS score, no CISA KEV listing, and no POC reference were supplied - exploitation status is therefore 'no public exploit identified at time of analysis'. The realistic priority is moderate-to-high for any product that auto-renders untrusted HEIF/AVIF (mail clients, chat apps, thumbnailers, browsers), and lower for batch tools that only touch trusted imagery.

An attacker emails or hosts a crafted .heic file whose mski box uses mskC.bits_per_pixel=8 and an ispe width of 64+ (even), with an iloc extent declaring a payload far larger than the computed pixel buffer. When a victim opens the image, or simply when an automated thumbnailer or mail client decodes it, MaskImageCodec::decode_mask_image() memcpys the oversized extent into the heap allocation, corrupting adjacent chunks and at minimum crashing the host process; with allocator grooming, the corruption may be steered toward higher-impact outcomes.