Skip to main content

libheif CVE-2026-32741

| EUVDEUVD-2026-30982 HIGH
Heap-based Buffer Overflow (CWE-122)
2026-05-19 GitHub_M
Buffer Overflow Heap Overflow Libheif
7.1
CVSS 3.1 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
7.1 HIGH
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
SUSE
HIGH
qualitative
Red Hat
7.1 HIGH
qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
High

Lifecycle Timeline

3
Patch available
May 19, 2026 - 21:02 EUVD
Source Code Evidence Fetched
May 19, 2026 - 20:45 vuln.today
Analysis Generated
May 19, 2026 - 20:45 vuln.today

DescriptionCVE.org

libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.21.2 and below contain a heap buffer overflow in MaskImageCodec::decode_mask_image(). When decoding a HEIF file containing a mask image (mski), the function copies the full iloc extent data into a pixel buffer using memcpy(dst, data.data(), data.size()). The copy length data.size() is determined by the iloc extent in the file (attacker-controlled), while the destination buffer is sized based on the declared image dimensions. Because no upper-bound check exists on the data length, a crafted file whose iloc extent exceeds the pixel buffer allocation overflows the heap. The vulnerable single-memcpy branch is reached when the mskC property specifies bits_per_pixel = 8 and the ispe property declares an even width ≥ 64 (so that stride == width), with no changes to default security limits or external codec plugins required. This issue has been fixed in version 1.22.0.

AnalysisAI

Heap buffer overflow in libheif versions 1.21.2 and below allows remote attackers to corrupt memory via a maliciously crafted HEIF file containing a mask image (mski) box. The flaw resides in MaskImageCodec::decode_mask_image(), where an attacker-controlled iloc extent length is memcpy'd into an undersized pixel buffer with no upper-bound validation, yielding heap corruption when a user opens the file. No public exploit identified at time of analysis, but the vulnerability is straightforward to trigger because the vulnerable branch is reachable under default library security limits.

Technical ContextAI

libheif (CPE cpe:2.3:a:strukturag:libheif) is the de-facto open-source decoder/encoder for HEIF and AVIF imagery, embedded across image viewers, browsers, photo pipelines, and ImageMagick/GDK-Pixbuf loaders. CWE-122 (heap-based buffer overflow) here arises because MaskImageCodec::decode_mask_image() trusts the iloc extent size from the file when computing the memcpy length, while the destination heap allocation is sized from the ispe (image spatial extent) dimensions and mskC bits_per_pixel. The single-memcpy fast path is taken when mskC.bits_per_pixel == 8 and ispe declares an even width ≥ 64 (so stride equals width), giving an attacker direct control over how many bytes are written past the allocation boundary.

RemediationAI

Vendor-released patch: upgrade libheif to 1.22.0 or later from https://github.com/strukturag/libheif/releases/tag/v1.22.0, per advisory GHSA-j3w5-7whq-p37q. Distribution packagers and applications that bundle libheif (image viewers, browsers, GIMP/ImageMagick stacks, thumbnailers, mail/chat clients) must rebuild against the patched library. If immediate upgrade is not possible, compensating controls include disabling automatic HEIF/AVIF thumbnail generation and preview in file managers and mail clients, stripping or sandboxing HEIF processing in upload pipelines (e.g., run conversion under seccomp/AppArmor or in a memory-safe wrapper), and refusing files that declare a mski box until patched; the trade-off is loss of HEIF preview/upload functionality and potential breakage of workflows that legitimately use mask images.

More in Libheif

View all
CVE-2023-49464 HIGH POC
8.8 Dec 07

libheif v1.17.5 was discovered to contain a segmentation violation via the function UncompressedImageCodec::get_luma_bit
CVE-2023-49463 HIGH POC
8.8 Dec 07

libheif v1.17.5 was discovered to contain a segmentation violation via the function find_exif_tag at /libheif/exif.cc. R
CVE-2023-49462 HIGH POC
8.8 Dec 07

libheif v1.17.5 was discovered to contain a segmentation violation via the component /libheif/exif.cc. Rated high severi
CVE-2023-49460 HIGH POC
8.8 Dec 07

libheif v1.17.5 was discovered to contain a segmentation violation via the function UncompressedImageCodec::decode_uncom
CVE-2019-11471 HIGH POC
8.8 Apr 23

libheif 1.4.0 has a use-after-free in heif::HeifContext::Image::set_alpha_channel in heif_context.h because heif_context
CVE-2024-41311 HIGH POC
8.1 Oct 15

In Libheif 1.17.6, insufficient checks in ImageOverlay::parse() decoding a heif file containing an overlay image with fo
CVE-2024-25269 HIGH POC
7.5 Mar 05

libheif <= 1.17.6 contains a memory leak in the function JpegEncoder::Encode. Rated high severity (CVSS 7.5), this vulne
CVE-2023-29659 MEDIUM POC
6.5 May 05

A Segmentation fault caused by a floating point exception exists in libheif 1.15.1 using crafted heif images via the hei
CVE-2025-29482 MEDIUM POC
6.2 Apr 07

Buffer Overflow vulnerability in libheif 1.19.7 allows a local attacker to execute arbitrary code via the SAO (Sample Ad
CVE-2026-32740 HIGH
8.8 May 19

Heap buffer overflow write in libheif (versions ≤ 1.21.2) lets a crafted HEIF/AVIF file write 64 bytes of attacker-contr
CVE-2023-0996 HIGH
7.8 Feb 24

There is a vulnerability in the strided image data parsing code in the emscripten wrapper for libheif. Rated high severi
CVE-2026-32882 HIGH
7.1 May 19

Heap buffer over-read in libheif versions 1.21.2 and prior allows remote attackers to crash applications or potentially

Same weakness CWE-122 – Heap-based Buffer Overflow

View all
CVE-2023-4911 HIGH POC
7.8
CVE-2025-24985 HIGH POC
7.8
CVE-2025-21418 HIGH
7.8
CVE-2025-24993 HIGH
7.8
CVE-2023-6246 HIGH POC
8.4
CVE-2026-42945 CRITICAL POC
9.2
CVE-2014-0781 CRITICAL POC
9.3
CVE-2024-30085 HIGH POC
7.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2017-11882 HIGH POC
7.8
CVE-2010-3333 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP7 Fixed

Share

CVE-2026-32741 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy