PT-2026-42003 · Libheif · Libheif

Elhananhaenel · Published 2026-05-19 · Updated 2026-05-28 · CVE-2026-32740

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions libheif versions prior to 1.22.0

Description A heap-buffer-overflow (write) exists in the grid tile compositing of the HEIF and AVIF file format decoder and encoder. An attacker can write 64 bytes of controlled data past the end of a chroma plane heap allocation by crafting a HEIF/AVIF file with a 1×4 grid of odd-height tiles. This occurs during normal image decoding with default build configuration, where the written bytes are chroma (Cb/Cr) pixel values from the attacking tile.

Recommendations Update to version 1.22.0.

Exploit

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2026-32740

ECHO-DBA8-54F3-0EB4

OPENSUSE-SU-2026:10878-1

Affected Products

Libheif

References · 28

• 🔥 https://github.com/strukturag/libheif/security/advisories/GHSA-frfr-f3vg-2g6j · Exploit
• https://ubuntu.com/security/CVE-2026-32740 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-32740 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10878-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-32740 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-32740 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-32740 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-32740 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-32740 · Vendor Advisory
• https://github.com/strukturag/libheif/releases/tag/v1.22.0 · Note
• https://suse.com/security/cve/CVE-2026-47714 · Note
• https://docs.bell-sw.com/security/cves/CVE-2026-32740 · Note
• https://suse.com/security/cve/CVE-2026-32739 · Note
• https://suse.com/security/cve/CVE-2026-47251 · Note
• https://suse.com/security/cve/CVE-2026-41069 · Note