CVE-2026-32741

libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.21.2 and below contain a heap buffer overflow in MaskImageCodec::decode_mask_image(). When decoding a HEIF file containing a mask image (mski), the function copies the full iloc extent data into a pixel buffer using memcpy(dst, data.data(), data.size()). The copy length data.size() is determined by the iloc extent in the file (attacker-controlled), while the destination buffer is sized based on the declared image dimensions. Because no upper-bound check exists on the data length, a crafted file whose iloc extent exceeds the pixel buffer allocation overflows the heap. The vulnerable single-memcpy branch is reached when the mskC property specifies bits_per_pixel = 8 and the ispe property declares an even width ≥ 64 (so that stride == width), with no changes to default security limits or external codec plugins required. This issue has been fixed in version 1.22.0.

CVSS v3 7.1 HIGH

7.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/strukturag/libheif/releases/tag/v1.22.0
https://github.com/strukturag/libheif/security/advisories/GHSA-j3w5-7whq-p37q
https://access.redhat.com/security/cve/CVE-2026-32741
https://bugzilla.redhat.com/show_bug.cgi?id=2480002
https://github.com/strukturag/libheif/security/advisories/GHSA-j3w5-7whq-p37q
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32741.json

Configurations

No configuration.

History

No history.

Information

Published : 2026-05-19 21:16

Updated : 2026-07-24 09:10

NVD link : CVE-2026-32741

Mitre link : CVE-2026-32741

CVE.ORG link : CVE-2026-32741

JSON object : View

Products Affected

No product.

CWE

CWE-122

Heap-based Buffer Overflow

CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

{"id": "CVE-2026-32741", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-32741", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-20T14:37:31.409194Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 4.2, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 4.2, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "strukturag", "product": "libheif", "versions": [{"status": "affected", "version": "< 1.22.0"}]}]}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "affectedData": [{"cpes": ["cpe:/o:redhat:enterprise_linux:10"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "packageName": "glycin-loaders", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}]}], "published": "2026-05-19T21:16:42.073", "references": [{"url": "https://github.com/strukturag/libheif/releases/tag/v1.22.0", "source": "security-advisories@github.com"}, {"url": "https://github.com/strukturag/libheif/security/advisories/GHSA-j3w5-7whq-p37q", "source": "security-advisories@github.com"}, {"url": "https://access.redhat.com/security/cve/CVE-2026-32741", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480002", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://github.com/strukturag/libheif/security/advisories/GHSA-j3w5-7whq-p37q", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}, {"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32741.json", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-122"}]}, {"type": "Secondary", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "description": [{"lang": "en", "value": "CWE-120"}]}], "descriptions": [{"lang": "en", "value": "libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.21.2 and below contain a heap buffer overflow in MaskImageCodec::decode_mask_image(). When decoding a HEIF file containing a mask image (mski), the function copies the full iloc extent data into a pixel buffer using memcpy(dst, data.data(), data.size()). The copy length data.size() is determined by the iloc extent in the file (attacker-controlled), while the destination buffer is sized based on the declared image dimensions. Because no upper-bound check exists on the data length, a crafted file whose iloc extent exceeds the pixel buffer allocation overflows the heap. The vulnerable single-memcpy branch is reached when the mskC property specifies bits_per_pixel = 8 and the ispe property declares an even width \u2265 64 (so that stride == width), with no changes to default security limits or external codec plugins required. This issue has been fixed in version 1.22.0."}, {"lang": "es", "value": "libheif es un decodificador y codificador de formato de archivo HEIF y AVIF. Las versiones 1.21.2 e inferiores contienen un desbordamiento de b\u00fafer de mont\u00f3n en MaskImageCodec::decode_mask_image(). Al decodificar un archivo HEIF que contiene una imagen de m\u00e1scara (mski), la funci\u00f3n copia los datos completos de la extensi\u00f3n iloc en un b\u00fafer de p\u00edxeles usando memcpy(dst, data.data(), data.size()). La longitud de copia data.size() est\u00e1 determinada por la extensi\u00f3n iloc en el archivo (controlada por el atacante), mientras que el b\u00fafer de destino se dimensiona en funci\u00f3n de las dimensiones de imagen declaradas. Debido a que no existe una comprobaci\u00f3n de l\u00edmite superior en la longitud de los datos, un archivo manipulado cuya extensi\u00f3n iloc excede la asignaci\u00f3n del b\u00fafer de p\u00edxeles desborda el mont\u00f3n. Se alcanza la rama vulnerable de single-memcpy cuando la propiedad mskC especifica bits_per_pixel = 8 y la propiedad ispe declara un ancho par ? 64 (de modo que stride == width), sin necesidad de cambios en los l\u00edmites de seguridad predeterminados o plugins de c\u00f3dec externos. Este problema ha sido solucionado en la versi\u00f3n 1.22.0."}], "lastModified": "2026-07-24T09:10:00.153", "sourceIdentifier": "security-advisories@github.com"}