CVE-2026-32741
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
libheif versions 1.21.2 and below have a heap buffer overflow in MaskImageCodec::decode_mask_image(). When decoding a HEIF file with a mask image, the copy length is attacker-controlled and may exceed the destination buffer size.
Risk Assessment
A remote attacker can supply a crafted HEIF file, causing application crash or potentially arbitrary code execution.
Recommendation
Update libheif to version 1.22.0 or later.
Other vulnerabilities in libheif
See all- CVE-2026-62377Medium
Vulnerability in libheif (up to 1.23.0) allows application crash via a crafted HEIF sequence that does not register sequence tracks, leading to assertion or undefined behavior when calling heif_context_get_track.
- CVE-2026-62292High
Vulnerability in libheif (versions 1.19.0 to 1.23.1) causing application crash when decoding a crafted uncompressed HEIF image with zlib compression. An offset calculation error leads to out-of-bounds read and crash.
- CVE-2026-62291Medium
Vulnerability in libheif (up to 1.23.0) allows heap corruption via a crafted image sequence with mismatched alpha plane dimensions, leading to out-of-bounds write during encoding.
- CVE-2026-62289Medium
Vulnerability in libheif (up to 1.23.0) allows crash or corrupt tiling results via a crafted HEIF/AVIF file with a clean aperture box that reduces dimensions to zero, causing underflow and assertion or incorrect results.
- CVE-2026-50142High
libheif from 1.19.0 to 1.23.0 has a vulnerability allowing unbounded heap allocation when processing a crafted HEIF sequence with msf1 brand. Box_stsz::parse() applies max_sequence_frames only to variable-size samples, and Track::load() uses 32-bit arithmetic that can bypass consistency checks. This can lead to gigabytes of memory allocation, crashing or stalling the process.
- CVE-2026-48029High
libheif versions 1.19.0 through 1.21.2 have a heap OOB read in ImageItem_Grid::decode_grid_tile via irot-induced tile-coordinate underflow. Version 1.22.0 fixes the issue.
- CVE-2026-47709Medium
Vulnerability in libheif before version 1.22.0. Decoding a malicious HEIF file without an `ispe` property (but with `uncC`) causes a crash in `heif_image_handle_get_image_tiling()` – via assertion in debug builds or null pointer read in release/ASan builds.
- CVE-2026-47254Medium
Vulnerability in libheif before version 1.22.0 causes a heap buffer overflow when reading HEIF/AVIF files. The Track::init_sample_timing_table() function stores an invalid chunk index, leading to an out-of-bounds read.
- CVE-2026-47251Medium
Vulnerability in libheif before version 1.22.0. The fix for CVE-2026-3949 introduced an integer overflow in the security check, allowing bypass and triggering an out-of-bounds heap read via a crafted HEIF file with a VVC track.
- CVE-2026-47247High
Two bugs in libheif prior to version 1.22.0 chain to leak process heap memory as visible pixel values in decoded grid images. An attacker uploading a crafted AVIF/HEIC file to a server-side image processor (WordPress, Sharp/libvips, ImageMagick, etc.) can recover heap data, including library function pointers sufficient to defeat ASLR, from publicly downloadable transcoded JPEG/PNG/WebP output.
Original NVD description (English source)
libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.21.2 and below contain a heap buffer overflow in MaskImageCodec::decode_mask_image(). When decoding a HEIF file containing a mask image (mski), the function copies the full iloc extent data into a pixel buffer using memcpy(dst, data.data(), data.size()). The copy length data.size() is determined by the iloc extent in the file (attacker-controlled), while the destination buffer is sized based on the declared image dimensions. Because no upper-bound check exists on the data length, a crafted file whose iloc extent exceeds the pixel buffer allocation overflows the heap. The vulnerable single-memcpy branch is reached when the mskC property specifies bits_per_pixel = 8 and the ispe property declares an even width ≥ 64 (so that stride == width), with no changes to default security limits or external codec plugins required. This issue has been fixed in version 1.22.0.