libheif CVE-2026-32882

|

EUVD

EUVD-2026-30981 HIGH

Out-of-bounds Read (CWE-125)

2026-05-19 GitHub_M

Information Disclosure Buffer Overflow Denial Of Service Libheif

7.1

CVSS 3.1 · Vendor: GitHub_M

Share

Severity by source

Vendor (GitHub_M) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

SUSE

HIGH

qualitative

Red Hat

7.1 HIGH

qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

High

Lifecycle Timeline

3

Patch available

May 19, 2026 - 21:02 EUVD

Source Code Evidence Fetched

May 19, 2026 - 20:45 vuln.today

Analysis Generated

May 19, 2026 - 20:45 vuln.today

DescriptionCVE.org

libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.21.2 and prior contain a heap buffer over-read in HeifPixelImage::overlay() in libheif/pixelimage.cc. When compositing an overlay image (iovl) whose child image has a different bit depth for the alpha channel than for the color channels, the function indexes into the alpha plane using the color channel stride (in_stride) instead of the previously retrieved alpha_stride, causing reads past the end of the alpha buffer (up to 3,123 bytes for a 100×50 image with 10-bit color and 8-bit alpha). A crafted HEIF file can exploit this to cause a denial of service (crash) or potentially disclose adjacent heap memory through leaked bytes embedded in the decoded output pixels. This issue has been fixed in versionThis issue has been fixed in version 1.22.0.

AnalysisAI

Heap buffer over-read in libheif versions 1.21.2 and prior allows remote attackers to crash applications or potentially leak adjacent heap memory by supplying a crafted HEIF/AVIF file with an overlay image (iovl) whose alpha channel bit depth differs from its color channels. The flaw in HeifPixelImage::overlay() uses the color channel stride to index into the alpha plane, reading up to 3,123 bytes beyond the alpha buffer for a 100×50 image with 10-bit color and 8-bit alpha. No public exploit identified at time of analysis, and the issue is fixed in version 1.22.0.

Technical ContextAI

libheif is a widely-used open-source C++ decoder/encoder library for HEIF (High Efficiency Image File Format) and AVIF, developed by struktur AG and embedded in many image viewers, browsers, and media pipelines (CPE: cpe:2.3:a:strukturag:libheif). The bug is a classic CWE-125 out-of-bounds read in libheif/pixelimage.cc: when compositing an overlay image with mismatched bit depths between the alpha and color planes, HeifPixelImage::overlay() retrieves alpha_stride but then incorrectly uses in_stride (the color channel stride) when walking the alpha plane. Because higher bit depths produce larger strides, the read pointer advances faster than the alpha allocation, leaking bytes from whatever heap memory follows the alpha buffer into the rendered output pixels - turning a parsing flaw into a potential heap information disclosure channel.

RemediationAI

Vendor-released patch: upgrade libheif to version 1.22.0 or later, available at https://github.com/strukturag/libheif/releases/tag/v1.22.0; downstream packagers and applications that bundle libheif must rebuild against this release. Until upgrading, mitigations are limited because HEIF parsing is typically invoked implicitly - practical compensating controls include disabling or removing HEIF/AVIF thumbnailers and preview handlers, blocking image/heic and image/avif MIME types at mail/web gateways for untrusted sources, and avoiding opening HEIF files from untrusted origins; the trade-off is loss of legitimate HEIF/AVIF rendering for users. Consult the GHSA advisory at https://github.com/strukturag/libheif/security/advisories/GHSA-hg7q-rjr2-8x46 for vendor guidance.

More in Libheif

View all

CVE-2023-49464 HIGH This Week POC

libheif v1.17.5 was discovered to contain a segmentation violation via the function UncompressedImageCodec::get_luma_bit

CVE-2023-49463 HIGH This Week POC

libheif v1.17.5 was discovered to contain a segmentation violation via the function find_exif_tag at /libheif/exif.cc. R

CVE-2023-49462 HIGH This Week POC

libheif v1.17.5 was discovered to contain a segmentation violation via the component /libheif/exif.cc. Rated high severi

CVE-2023-49460 HIGH This Week POC

libheif v1.17.5 was discovered to contain a segmentation violation via the function UncompressedImageCodec::decode_uncom

CVE-2019-11471 HIGH This Week POC

libheif 1.4.0 has a use-after-free in heif::HeifContext::Image::set_alpha_channel in heif_context.h because heif_context

CVE-2024-41311 HIGH This Week POC

In Libheif 1.17.6, insufficient checks in ImageOverlay::parse() decoding a heif file containing an overlay image with fo

CVE-2024-25269 HIGH This Week POC

libheif <= 1.17.6 contains a memory leak in the function JpegEncoder::Encode. Rated high severity (CVSS 7.5), this vulne

CVE-2023-29659 MEDIUM This Month POC

A Segmentation fault caused by a floating point exception exists in libheif 1.15.1 using crafted heif images via the hei

CVE-2025-29482 MEDIUM This Month POC

Buffer Overflow vulnerability in libheif 1.19.7 allows a local attacker to execute arbitrary code via the SAO (Sample Ad

CVE-2026-32740 HIGH This Week

Heap buffer overflow write in libheif (versions ≤ 1.21.2) lets a crafted HEIF/AVIF file write 64 bytes of attacker-contr

CVE-2023-0996 HIGH This Week

There is a vulnerability in the strided image data parsing code in the emscripten wrapper for libheif. Rated high severi

CVE-2026-32741 HIGH This Week

Heap buffer overflow in libheif versions 1.21.2 and below allows remote attackers to corrupt memory via a maliciously cr

Same weakness CWE-125 – Out-of-bounds Read

View all

CVE-2014-0160 HIGH POC

CVE-2016-5198 HIGH POC

CVE-2016-1646 HIGH POC

CVE-2025-5777 HIGH POC

CVE-2017-5030 HIGH POC

CVE-2016-4523 HIGH

CVE-2024-48456 HIGH POC

CVE-2024-48457 HIGH POC

Same technique Information Disclosure

View all

CVE-2013-2251 CRITICAL POC

CVE-2017-5638 CRITICAL POC

CVE-2025-24813 CRITICAL POC

CVE-2015-1701 HIGH POC

CVE-2017-0147 HIGH POC

CVE-2014-6324 HIGH POC

CVE-2023-7028 CRITICAL POC

CVE-2017-0213 HIGH POC

Vendor StatusVendor

SUSE

Severity: High

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7	Fixed
SUSE Linux Enterprise Module for Desktop Applications 15 SP7	Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP7	Fixed
SUSE Linux Enterprise Server 15 SP7	Fixed

Share

CVE-2026-32882 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy