CVE-2026-32740 Details
Description
libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.21.2 and prior contain a heap-buffer-overflow (write) vulnerability in the grid tile compositing, allowing an attacker to write 64 bytes of fully attacker-controlled data past the end of a chroma plane heap allocation by crafting a HEIF/AVIF file with a 1×4 grid of odd-height tiles. The overflow is triggered during normal image decoding with default build configuration. The written bytes are chroma (Cb/Cr) pixel values from the attacking tile, giving the attacker full control over the overflow content. This issue has been fixed in version 1.22.0.
A heap-buffer-overflow vulnerability has been identified in libheif, a library for decoding and encoding HEIF and AVIF file formats. This vulnerability exists in versions through 1.21.2 and arises during the grid tile compositing process. By crafting a HEIF or AVIF file with a 1×4 grid of odd-height tiles, an attacker can exploit this vulnerability to write 64 bytes of attacker-controlled data beyond the end of a chroma plane heap allocation. The overflow occurs during normal image decoding with the default build configuration, allowing the attacker to manipulate chroma pixel values and potentially execute arbitrary code.
Users can upgrade to libheif version 1.22.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2026-32740 | redhat-SADP | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2479969 | redhat-SADP | |
| https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32740.json | redhat-SADP | |
| https://github.com/strukturag/libheif/releases/tag/v1.22.0 | [email protected] | Release Notes |
| https://github.com/strukturag/libheif/security/advisories/GHSA-frfr-f3vg-2g6j | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-787 | Out-of-bounds Write | redhat-SADP |
| CWE-787 | Out-of-bounds Write | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| struktur libheif | < 1.22.0 |
CPE
Remediation
| |
Change History
9 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jul 15, 2026 | CVE Modified | redhat-SADP |
| Jun 30, 2026 | CVE Modified | redhat-SADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 21, 2026 | CVE Modified | CISA-ADP |
| May 20, 2026 | Initial Analysis | [email protected] |
| May 20, 2026 | CVE Modified | CISA-ADP |
| May 19, 2026 | New CVE Received | [email protected] |