libheif CVE-2026-32814

The vulnerability requires the target to process a crafted HEIF or AVIF file containing a grid image layout (using the HEIF grid item type per ISO/IEC 23008-12) with at least one intentionally corrupted constituent tile. The strict_decoding=false setting must be in effect - this is the library default and requires no attacker-controlled configuration change. Per CVSS PR:N, no authentication is required from the attacker; per UI:R, a file-processing action must occur, such as a server decoding an uploaded image or a user opening a malicious .heic file in a client application. Exploitation is strictly limited to confidentiality (C:H); integrity and availability are unaffected per the CVSS vector. In client-side contexts the attacker can typically recover only heap data from their own process, substantially limiting value. High-impact exploitation requires a multi-tenant server-side pipeline where multiple users' decode requests are handled within the same worker process, enabling heap cross-contamination to expose other users' in-memory data as recoverable pixel output.

The CVSS 6.5 score (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) reflects an unauthenticated network-exploitable confidentiality impact that requires a file-processing action. For server-side deployments the UI:R flag is operationally misleading: the 'user interaction' is effectively the server's own image pipeline ingesting the uploaded file, not a human click, making automated server-side exploitation more realistic than the score implies. Real-world risk is strongly context-dependent: multi-tenant server-side processors that re-encode output expose cross-process heap contents to attackers, a materially higher impact than the unchanged-scope CVSS rating suggests. Client-side desktop applications expose only the local user's own heap, significantly reducing attacker value. EPSS data was not provided in the supplied intelligence; however, the low attack complexity and absence of any authentication requirement make server-side automated exploitation feasible once a reliable file crafter is developed. No KEV listing and no public POC are confirmed at time of analysis, suggesting no widespread opportunistic exploitation is currently observed. The default-on nature of the vulnerable code path (strict_decoding=false) means the vulnerable surface is the entire installed base without any configuration prerequisite from the attacker.

An attacker crafts a HEIF grid image with a deliberately corrupted tile using a hex editor or custom tool and submits it to a server-side image processing endpoint such as a profile picture upload. The server decodes the file with libheif at default settings, receives heif_error_Ok, and re-encodes the full canvas as a JPEG or PNG for thumbnail delivery. The attacker retrieves the output image and reads the pixel values in the region corresponding to the corrupted tile, recovering 12,288+ bytes of raw heap memory that may contain fragments of authentication tokens, database query results, or other in-memory data from the process - including content from other users' recent requests processed by the same worker. No public POC has been identified at time of analysis, but exploitation requires only HEIF file-format knowledge and the ability to submit and retrieve processed images.