PT-2026-42007 · Libheif · Libheif

Published 2026-05-19 · Updated 2026-05-28 · CVE-2026-32882

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

Name of the Vulnerable Software and Affected Versions libheif versions prior to 1.22.0

Description A heap buffer over-read exists in the HeifPixelImage::overlay() function within libheif/pixelimage.cc. This occurs when compositing an overlay image where the child image uses a different bit depth for the alpha channel compared to the color channels. The function incorrectly uses the color channel stride in stride instead of the alpha stride to index the alpha plane, leading to reads beyond the alpha buffer. A specially crafted HEIF file can trigger this issue, resulting in a denial of service via a crash or the potential disclosure of adjacent heap memory through leaked bytes in the decoded output pixels.

Recommendations Update to version 1.22.0.

Exploit

Fix

DoS

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2026-32882

OPENSUSE-SU-2026:10878-1

Affected Products

Libheif

References · 27

• 🔥 https://github.com/strukturag/libheif/security/advisories/GHSA-hg7q-rjr2-8x46 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-32882 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-32882 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-32882 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10878-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-32882 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-32882 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-32882 · Vendor Advisory
• https://github.com/strukturag/libheif/releases/tag/v1.22.0 · Note
• https://suse.com/security/cve/CVE-2026-47254 · Note
• https://suse.com/security/cve/CVE-2026-47709 · Note
• https://suse.com/security/cve/CVE-2026-47247 · Note
• https://suse.com/security/cve/CVE-2026-41069 · Note
• https://suse.com/security/cve/CVE-2026-48029 · Note
• https://suse.com/security/cve/CVE-2026-3950 · Note