CVE-2026-32882 strukturag CVE debrief

Who should care

Teams that ship or embed libheif, especially software that opens untrusted HEIF or AVIF files, should treat this as important. That includes application maintainers, distro/package managers, security teams, and anyone running image-processing services that decode user-supplied media.

Technical summary

According to the CVE description and GitHub advisory/release references, the flaw is in HeifPixelImage::overlay() in libheif/pixelimage.cc. When compositing an overlay image (iovl), if the child image’s alpha channel has a different bit depth from the color channels, the function uses the color-channel stride (in_stride) while indexing the alpha plane instead of the previously obtained alpha_stride. That mismatch can read past the end of the alpha buffer, with the supplied description estimating reads of up to 3,123 bytes for a 100×50 image using 10-bit color and 8-bit alpha. The result is a heap over-read consistent with CWE-125, with denial-of-service and limited memory-disclosure impact.

Defensive priority

High. The vulnerability is publicly disclosed, has a direct fix available in libheif 1.22.0, and can be triggered by crafted files in a common media-parsing path.

Recommended defensive actions

• Upgrade libheif to version 1.22.0 or later everywhere it is bundled or installed.
• Inventory products and services that depend on libheif and verify the shipped package version, including transitive dependencies.
• Prioritize patching systems that process untrusted HEIF or AVIF content, such as upload pipelines, converters, and thumbnailing services.
• Treat unexpected crashes or malformed-pixel output during HEIF/AVIF decoding as a signal to investigate exposure to this bug.
• Add or expand regression tests around overlay compositing paths, especially mixed bit-depth alpha/color cases, to prevent reintroduction.

Evidence notes

The source corpus identifies CVE-2026-32882 as a libheif issue fixed in release 1.22.0 and references the GitHub security advisory GHSA-hg7q-rjr2-8x46. NVD metadata lists CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H, CWE-125, and vulnStatus Deferred at the time of the supplied modified record. PublishedAt for the CVE is 2026-05-19T21:16:42.363Z and ModifiedAt is 2026-05-20T18:16:26.880Z.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.