PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-32741 strukturag CVE debrief

CVE-2026-32741 describes a heap buffer overflow in libheif’s mask image decoding path. A crafted HEIF file containing a mask image can cause MaskImageCodec::decode_mask_image() to copy attacker-controlled extent data into a destination buffer that was sized from the declared image dimensions, creating a heap overwrite. The issue is fixed in libheif 1.22.0.

Vendor
strukturag
Product
libheif
CVSS
HIGH 7.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-19
Original CVE updated
2026-07-24
Advisory published
2026-05-19
Advisory updated
2026-07-24

Who should care

Security, platform, and application teams that use libheif directly or indirectly in services that accept untrusted HEIF/AVIF content, including upload pipelines, media processing backends, and client applications that open user-supplied images.

Technical summary

In affected versions (1.21.2 and below), decoding a HEIF mask image (mski) can reach a single memcpy(dst, data.data(), data.size()) branch in MaskImageCodec::decode_mask_image(). The source length comes from the iloc extent in the file, which is attacker-controlled, while the destination buffer is allocated according to the declared image dimensions. When the file’s mskC property uses bits_per_pixel = 8 and the ispe property declares an even width of at least 64, the stride matches the width and no additional security-limit or external-plugin changes are required for the vulnerable copy to occur. The result is a heap buffer overflow categorized as CWE-122.

Defensive priority

High for any system that parses untrusted HEIF/AVIF files. Prioritize internet-facing upload services and applications where a crafted image could be processed automatically. The source record reports CVSS 7.1 (HIGH), with memory corruption affecting availability and some integrity impact.

Recommended defensive actions

  • Upgrade libheif to version 1.22.0 or later.
  • Inventory products and services that bundle or statically link libheif, including transitive dependencies.
  • Treat untrusted HEIF/AVIF decoding as a high-risk operation until patched; isolate it with sandboxing or process separation where feasible.
  • Validate that deployed packages and containers do not still ship libheif 1.21.2 or earlier.
  • Track vendor and upstream advisories for any downstream products that embed libheif.

Evidence notes

The CVE record was published on 2026-05-19T21:16:42.073Z and modified on 2026-05-20T17:16:21.133Z. The supplied NVD source item marks the vulnStatus as Deferred and lists CVSS v3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H with CWE-122. The supplied official references point to the libheif 1.22.0 release and the GitHub Security Advisory GHSA-j3w5-7whq-p37q, both used here as the basis for the fixed-version and vulnerability description.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-32741 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-32741

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-32741 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-32741

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.