PT-2026-42005 · Libheif · Libheif

Published

2026-05-19

·

Updated

2026-05-28

·

CVE-2026-32741

CVSS v3.1

7.1

High

VectorAV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Name of the Vulnerable Software and Affected Versions libheif versions prior to 1.22.0
Description A heap buffer overflow exists in the MaskImageCodec::decode mask image() function. This occurs when decoding a HEIF file containing a mask image (mski) because the function copies the full iloc extent data into a pixel buffer using memcpy() without an upper-bound check on the data length. An attacker can craft a file where the iloc extent exceeds the pixel buffer allocation, leading to a heap overflow. This condition is met when the mskC property specifies bits per pixel = 8 and the ispe property declares an even width ≥ 64, ensuring the stride equals the width.
Recommendations Update to version 1.22.0.

Exploit

Fix

Heap Based Buffer Overflow

Weakness Enumeration

Related Identifiers

CVE-2026-32741
ECHO-0DFF-8373-3408
OPENSUSE-SU-2026:10878-1

Affected Products

Libheif