CVE-2026-32741
Heap Buffer Overflow in libheif Image Decoder
Publication date: 2026-05-19
Last updated on: 2026-05-20
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| libheif | libheif | to 1.22.0 (exc) |
| libheif | libheif | 1.22.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-122 | A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in libheif versions 1.21.2 and below, which is a HEIF and AVIF file format decoder and encoder. It is a heap buffer overflow in the function MaskImageCodec::decode_mask_image(). When decoding a HEIF file containing a mask image, the function copies data into a pixel buffer using memcpy without properly checking the size of the data against the buffer size. The length of data copied is attacker-controlled and can exceed the allocated buffer size, causing a heap overflow. This occurs under specific conditions related to image properties such as bits_per_pixel being 8 and the image width being even and at least 64. The issue was fixed in version 1.22.0.
How can this vulnerability impact me? :
This heap buffer overflow vulnerability can lead to a denial of service (application crash) or potentially allow an attacker to execute arbitrary code or cause other unintended behavior by exploiting the overflow. Since the vulnerability is triggered by processing a specially crafted HEIF file, an attacker could use this to compromise systems that decode such files without proper patching.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability in libheif versions 1.21.2 and below can be mitigated by upgrading to version 1.22.0 or later, where the heap buffer overflow issue in MaskImageCodec::decode_mask_image() has been fixed.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability in libheif is a heap buffer overflow that can lead to denial of service or potential code execution via heap corruption. It impacts the integrity and availability of systems processing HEIF files but does not directly affect confidentiality.
Since the vulnerability does not involve unauthorized access to or disclosure of personal data, it does not directly violate data protection regulations such as GDPR or HIPAA. However, the potential for denial of service or code execution could indirectly impact compliance by disrupting availability or integrity of systems that handle regulated data.
Organizations relying on libheif for image processing should apply the fixed version (1.22.0) to mitigate risks and maintain compliance with standards that require maintaining system integrity and availability.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by analyzing HEIF files for the presence of a mask image (mski) item with specific properties that trigger the heap buffer overflow. The conditions include bits_per_pixel set to 8, an even width of at least 64, and an iloc extent length larger than the pixel buffer allocation.
A practical detection approach involves using the provided proof-of-concept (PoC) script `gen_poc.py` to generate malformed HEIF files that trigger the overflow, which can then be tested against your libheif installation.
For runtime detection, tools like AddressSanitizer (ASAN) or GDB can be used to monitor for heap corruption or crashes when decoding suspicious HEIF files.
While no specific commands are provided in the resources, you can test your system by attempting to decode HEIF files with the vulnerable libheif version (≤ 1.21.2) using command-line tools such as `heif-dec` and observe for crashes or abnormal behavior.