CVE-2026-32740
Heap Buffer Overflow in libheif Image Decoder
Publication date: 2026-05-19
Last updated on: 2026-05-20
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| struktur | libheif | to 1.22.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-787 | The product writes data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a heap-buffer-overflow in the libheif library, which is used for decoding and encoding HEIF and AVIF image files. It occurs in the grid tile compositing feature when decoding specially crafted HEIF/AVIF files that contain a 1×4 grid of tiles with odd heights. Due to a rounding error in calculating chroma plane offsets and copy height, the software writes 64 bytes of attacker-controlled data beyond the allocated memory buffer for chroma pixels. This overflow happens during normal image decoding and allows an attacker to overwrite adjacent memory, potentially corrupting important data structures.
How can this vulnerability impact me? :
This vulnerability can have severe impacts including remote code execution, denial of service, and data corruption. An attacker can craft a malicious image file that, when decoded, causes the overflow to overwrite adjacent heap objects such as vtable pointers or allocator metadata. This can lead to execution of arbitrary code with the privileges of the application processing the image. It can also crash the application, causing denial of service. The attacker can precisely control the overflow to target specific memory areas, increasing the risk and impact.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability is triggered during normal image decoding of crafted HEIF/AVIF files with a specific 1×4 grid of odd-height tiles. Detection involves identifying attempts to process such maliciously crafted image files.
Since the vulnerability arises from heap-buffer-overflow during decoding, monitoring for crashes or AddressSanitizer aborts in applications using libheif (versions up to 1.21.2) can indicate exploitation attempts.
No explicit detection commands are provided in the resources. However, you can check the libheif version installed on your system to identify if it is vulnerable:
- Run `heif-convert --version` or check the package version via your package manager (e.g., `dpkg -l | grep libheif` on Debian-based systems or `rpm -q libheif` on RedHat-based systems).
Additionally, monitoring logs for crashes or unusual behavior in image processing applications that use libheif may help detect exploitation attempts.
What immediate steps should I take to mitigate this vulnerability?
The primary mitigation step is to upgrade libheif to version 1.22.0 or later, where this heap-buffer-overflow vulnerability has been fixed.
Until the upgrade can be applied, avoid processing untrusted or suspicious HEIF/AVIF files, especially those that might contain a 1×4 grid of odd-height tiles.
Consider running image decoding processes with security mitigations such as sandboxing or using AddressSanitizer builds to detect and prevent exploitation.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability in libheif allows an attacker to execute remote code or cause denial of service by exploiting a heap-buffer-overflow during image decoding. This can lead to unauthorized access, modification, or disruption of data handled by applications using libheif.
Such security issues can impact compliance with standards and regulations like GDPR and HIPAA, which require protection of data confidentiality, integrity, and availability. If exploited, this vulnerability could result in data breaches or service interruptions, potentially violating these regulatory requirements.
Therefore, organizations using vulnerable versions of libheif should update to version 1.22.0 or later to mitigate risks and maintain compliance with relevant security standards.