Vulnerability-Lookup

CVE-2026-32740 (GCVE-0-2026-32740)

Vulnerability from cvelistv5 – Published: 2026-05-19 19:22 – Updated: 2026-07-15 01:07

Title

libheif: Heap-Buffer-Overflow Write in Grid Tile Chroma Compositing

Summary

libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.21.2 and prior contain a heap-buffer-overflow (write) vulnerability in the grid tile compositing, allowing an attacker to write 64 bytes of fully attacker-controlled data past the end of a chroma plane heap allocation by crafting a HEIF/AVIF file with a 1×4 grid of odd-height tiles. The overflow is triggered during normal image decoding with default build configuration. The written bytes are chroma (Cb/Cr) pixel values from the attacking tile, giving the attacker full control over the overflow content. This issue has been fixed in version 1.22.0.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-21 03:55 UTC

CWE

CWE-787 - Out-of-bounds Write

Assigner

GitHub_M mitre root

References

5 references

URL	Tags
https://github.com/strukturag/libheif/security/ad…	x_refsource_CONFIRM
https://github.com/strukturag/libheif/releases/ta…	x_refsource_MISC
https://access.redhat.com/security/cve/CVE-2026-32740	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2479969	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex

Impacted products

2 products

Vendor	Product	Version	CPE status
strukturag	libheif	Affected: < 1.22.0	guessed
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-32740",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-21T03:55:32.284407Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-21T13:06:55.372Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "unaffected",
            "packageName": "glycin-loaders",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-05-19T19:22:07.743Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in libheif, a library for decoding and encoding HEIF and AVIF image files. This heap-buffer-overflow vulnerability allows a remote attacker to write arbitrary data beyond the intended memory boundary. By crafting a malicious HEIF/AVIF file with a specific grid tile configuration, an attacker could potentially achieve arbitrary code execution or cause a denial of service."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-787",
                "description": "Out-of-bounds Write",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-15T01:07:45.388Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-32740"
          },
          {
            "name": "RHBZ#2479969",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2479969"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32740.json"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-05-19T20:01:03.545Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-05-19T19:22:07.743Z",
            "value": "Made public."
          }
        ],
        "title": "libheif: libheif: Arbitrary code execution or denial of service via crafted HEIF/AVIF file",
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "libheif",
          "vendor": "strukturag",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.22.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.21.2 and prior contain a heap-buffer-overflow (write) vulnerability in the grid tile compositing, allowing an attacker to write 64 bytes of fully attacker-controlled data past the end of a chroma plane heap allocation by crafting a HEIF/AVIF file with a 1\u00d74 grid of odd-height tiles. The overflow is triggered during normal image decoding with default build configuration. The written bytes are chroma (Cb/Cr) pixel values from the attacking tile, giving the attacker full control over the overflow content. This issue has been fixed in version 1.22.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "CWE-787: Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-19T19:22:07.743Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/strukturag/libheif/security/advisories/GHSA-frfr-f3vg-2g6j",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/strukturag/libheif/security/advisories/GHSA-frfr-f3vg-2g6j"
        },
        {
          "name": "https://github.com/strukturag/libheif/releases/tag/v1.22.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/strukturag/libheif/releases/tag/v1.22.0"
        }
      ],
      "source": {
        "advisory": "GHSA-frfr-f3vg-2g6j",
        "discovery": "UNKNOWN"
      },
      "title": "libheif: Heap-Buffer-Overflow Write in Grid Tile Chroma Compositing"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-32740",
    "datePublished": "2026-05-19T19:22:07.743Z",
    "dateReserved": "2026-03-13T15:02:00.628Z",
    "dateUpdated": "2026-07-15T01:07:45.388Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-32740",
      "date": "2026-09-13",
      "epss": "0.00514",
      "percentile": "0.42186"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-32740\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-05-19T20:16:18.917\",\"lastModified\":\"2026-07-24T09:10:00.153\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.21.2 and prior contain a heap-buffer-overflow (write) vulnerability in the grid tile compositing, allowing an attacker to write 64 bytes of fully attacker-controlled data past the end of a chroma plane heap allocation by crafting a HEIF/AVIF file with a 1\u00d74 grid of odd-height tiles. The overflow is triggered during normal image decoding with default build configuration. The written bytes are chroma (Cb/Cr) pixel values from the attacking tile, giving the attacker full control over the overflow content. This issue has been fixed in version 1.22.0.\"},{\"lang\":\"es\",\"value\":\"libheif es un decodificador y codificador de formato de archivo HEIF y AVIF. Las versiones 1.21.2 y anteriores contienen una vulnerabilidad de desbordamiento de b\u00fafer de mont\u00f3n (escritura) en la composici\u00f3n de mosaicos de cuadr\u00edcula, permitiendo a un atacante escribir 64 bytes de datos totalmente controlados por el atacante m\u00e1s all\u00e1 del final de una asignaci\u00f3n de mont\u00f3n del plano de croma al crear un archivo HEIF/AVIF con una cuadr\u00edcula de 1\u00d74 de mosaicos de altura impar. El desbordamiento se activa durante la decodificaci\u00f3n normal de la imagen con la configuraci\u00f3n de compilaci\u00f3n predeterminada. Los bytes escritos son valores de p\u00edxeles de croma (Cb/Cr) del mosaico atacante, dando al atacante control total sobre el contenido del desbordamiento. Este problema ha sido solucionado en la versi\u00f3n 1.22.0.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"strukturag\",\"product\":\"libheif\",\"versions\":[{\"version\":\"\u003c 1.22.0\",\"status\":\"affected\"}]}]},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"affectedData\":[{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"glycin-loaders\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10\"]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-05-21T03:55:32.284407Z\",\"id\":\"CVE-2026-32740\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:struktur:libheif:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"1.22.0\",\"matchCriteriaId\":\"CB01CAAF-1D64-461B-8CC0-3CF2FBAC60A5\"}]}]}],\"references\":[{\"url\":\"https://github.com/strukturag/libheif/releases/tag/v1.22.0\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://github.com/strukturag/libheif/security/advisories/GHSA-frfr-f3vg-2g6j\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Exploit\",\"Vendor Advisory\"]},{\"url\":\"https://access.redhat.com/security/cve/CVE-2026-32740\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=2479969\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32740.json\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-06-30T04:06:36+00:00",
      "cve": "CVE-2026-32740",
      "id": "CVE-2026-32740",
      "initial_release_date": "2026-05-19T19:22:07.743000+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "libheif: libheif: Arbitrary code execution or denial of service via crafted HEIF/AVIF file",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32740.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-11T01:28:25Z",
      "cve": "CVE-2026-32740",
      "id": "CVE-2026-32740",
      "initial_release_date": "2026-05-21T02:29:23Z",
      "product_status:known_not_affected": "27",
      "product_status:recommended": "74",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-32740",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-32740.json",
      "version": "8"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"libheif: libheif: Arbitrary code execution or denial of service via crafted HEIF/AVIF file\", \"metrics\": [{\"other\": {\"type\": \"Red Hat severity rating\", \"content\": {\"value\": \"Important\", \"namespace\": \"https://access.redhat.com/security/updates/classification/\"}}}, {\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 8.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10\", \"packageName\": \"glycin-loaders\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-05-19T20:01:03.545Z\", \"value\": \"Reported to Red Hat.\"}, {\"lang\": \"en\", \"time\": \"2026-05-19T19:22:07.743Z\", \"value\": \"Made public.\"}], \"x_adpType\": \"supplier\", \"datePublic\": \"2026-05-19T19:22:07.743Z\", \"references\": [{\"url\": \"https://access.redhat.com/security/cve/CVE-2026-32740\", \"tags\": [\"vdb-entry\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=2479969\", \"name\": \"RHBZ#2479969\", \"tags\": [\"issue-tracking\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32740.json\", \"tags\": [\"x_sadp-csaf-vex\"]}], \"x_generator\": {\"engine\": \"sadp-cli 1.0.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A flaw was found in libheif, a library for decoding and encoding HEIF and AVIF image files. This heap-buffer-overflow vulnerability allows a remote attacker to write arbitrary data beyond the intended memory boundary. By crafting a malicious HEIF/AVIF file with a specific grid tile configuration, an attacker could potentially achieve arbitrary code execution or cause a denial of service.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-787\", \"description\": \"Out-of-bounds Write\"}]}], \"providerMetadata\": {\"orgId\": \"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\", \"shortName\": \"redhat-SADP\", \"dateUpdated\": \"2026-07-15T01:07:45.388Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-32740\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-05-21T03:55:32.284407Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-05-20T13:49:03.011Z\"}}], \"cna\": {\"title\": \"libheif: Heap-Buffer-Overflow Write in Grid Tile Chroma Compositing\", \"source\": {\"advisory\": \"GHSA-frfr-f3vg-2g6j\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 8.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"strukturag\", \"product\": \"libheif\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 1.22.0\"}]}], \"references\": [{\"url\": \"https://github.com/strukturag/libheif/security/advisories/GHSA-frfr-f3vg-2g6j\", \"name\": \"https://github.com/strukturag/libheif/security/advisories/GHSA-frfr-f3vg-2g6j\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/strukturag/libheif/releases/tag/v1.22.0\", \"name\": \"https://github.com/strukturag/libheif/releases/tag/v1.22.0\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.21.2 and prior contain a heap-buffer-overflow (write) vulnerability in the grid tile compositing, allowing an attacker to write 64 bytes of fully attacker-controlled data past the end of a chroma plane heap allocation by crafting a HEIF/AVIF file with a 1\\u00d74 grid of odd-height tiles. The overflow is triggered during normal image decoding with default build configuration. The written bytes are chroma (Cb/Cr) pixel values from the attacking tile, giving the attacker full control over the overflow content. This issue has been fixed in version 1.22.0.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-787\", \"description\": \"CWE-787: Out-of-bounds Write\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-05-19T19:22:07.743Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-32740\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-07-15T01:07:45.388Z\", \"dateReserved\": \"2026-03-13T15:02:00.628Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-05-19T19:22:07.743Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-32740

Vulnerability from fkie_nvd - Published: 2026-05-19 20:16 - Updated: 2026-07-24 09:10

Severity

8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/strukturag/libheif/releases/tag/v1.22.0	Release Notes
security-advisories@github.com	https://github.com/strukturag/libheif/security/advisories/GHSA-frfr-f3vg-2g6j	Exploit, Vendor Advisory
0b0ca135-0b70-47e7-9f44-1890c2a1c46c	https://access.redhat.com/security/cve/CVE-2026-32740
0b0ca135-0b70-47e7-9f44-1890c2a1c46c	https://bugzilla.redhat.com/show_bug.cgi?id=2479969
0b0ca135-0b70-47e7-9f44-1890c2a1c46c	https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32740.json

Impacted products

	Vendor	Product	Version
	struktur	libheif	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "libheif",
          "vendor": "strukturag",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.22.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    },
    {
      "affectedData": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "unaffected",
          "packageName": "glycin-loaders",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        }
      ],
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:struktur:libheif:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "CB01CAAF-1D64-461B-8CC0-3CF2FBAC60A5",
              "versionEndExcluding": "1.22.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.21.2 and prior contain a heap-buffer-overflow (write) vulnerability in the grid tile compositing, allowing an attacker to write 64 bytes of fully attacker-controlled data past the end of a chroma plane heap allocation by crafting a HEIF/AVIF file with a 1\u00d74 grid of odd-height tiles. The overflow is triggered during normal image decoding with default build configuration. The written bytes are chroma (Cb/Cr) pixel values from the attacking tile, giving the attacker full control over the overflow content. This issue has been fixed in version 1.22.0."
    },
    {
      "lang": "es",
      "value": "libheif es un decodificador y codificador de formato de archivo HEIF y AVIF. Las versiones 1.21.2 y anteriores contienen una vulnerabilidad de desbordamiento de b\u00fafer de mont\u00f3n (escritura) en la composici\u00f3n de mosaicos de cuadr\u00edcula, permitiendo a un atacante escribir 64 bytes de datos totalmente controlados por el atacante m\u00e1s all\u00e1 del final de una asignaci\u00f3n de mont\u00f3n del plano de croma al crear un archivo HEIF/AVIF con una cuadr\u00edcula de 1\u00d74 de mosaicos de altura impar. El desbordamiento se activa durante la decodificaci\u00f3n normal de la imagen con la configuraci\u00f3n de compilaci\u00f3n predeterminada. Los bytes escritos son valores de p\u00edxeles de croma (Cb/Cr) del mosaico atacante, dando al atacante control total sobre el contenido del desbordamiento. Este problema ha sido solucionado en la versi\u00f3n 1.22.0."
    }
  ],
  "id": "CVE-2026-32740",
  "lastModified": "2026-07-24T09:10:00.153",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-32740",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-05-21T03:55:32.284407Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-05-19T20:16:18.917",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/strukturag/libheif/releases/tag/v1.22.0"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/strukturag/libheif/security/advisories/GHSA-frfr-f3vg-2g6j"
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "url": "https://access.redhat.com/security/cve/CVE-2026-32740"
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2479969"
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32740.json"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ],
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "type": "Secondary"
    }
  ]
}

SUSE-SU-2026:22153-1

Vulnerability from csaf_suse - Published: 2026-06-17 08:36 - Updated: 2026-06-17 08:36

Summary

Security update for libheif

Severity

Important

Scope

20 vulnerabilities in this advisory, including CVE-2026-32740.

CVE-2026-32740

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Recommended: 68 products

Open the full advisory

ubuntu-cve-2026-32740

Vulnerability from osv_ubuntu

Published

2026-05-19 20:16

Modified

2026-06-30 16:20

Summary

Details

Severity

8.8 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

8.8 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2026-32740	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-32740	REPORT
	https://github.com/strukturag/libheif/releases/ta…	REPORT
	https://github.com/strukturag/libheif/security/ad…	REPORT
	https://ubuntu.com/security/notices/USN-8454-1	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "heif-gdk-pixbuf",
            "binary_version": "1.20.2-1ubuntu0.4"
          },
          {
            "binary_name": "heif-thumbnailer",
            "binary_version": "1.20.2-1ubuntu0.4"
          },
          {
            "binary_name": "heif-view",
            "binary_version": "1.20.2-1ubuntu0.4"
          },
          {
            "binary_name": "libheif-examples",
            "binary_version": "1.20.2-1ubuntu0.4"
          },
          {
            "binary_name": "libheif-plugin-aomdec",
            "binary_version": "1.20.2-1ubuntu0.4"
          },
          {
            "binary_name": "libheif-plugin-aomenc",
            "binary_version": "1.20.2-1ubuntu0.4"
          },
          {
            "binary_name": "libheif-plugin-dav1d",
            "binary_version": "1.20.2-1ubuntu0.4"
          },
          {
            "binary_name": "libheif-plugin-ffmpegdec",
            "binary_version": "1.20.2-1ubuntu0.4"
          },
          {
            "binary_name": "libheif-plugin-j2kdec",
            "binary_version": "1.20.2-1ubuntu0.4"
          },
          {
            "binary_name": "libheif-plugin-j2kenc",
            "binary_version": "1.20.2-1ubuntu0.4"
          },
          {
            "binary_name": "libheif-plugin-jpegdec",
            "binary_version": "1.20.2-1ubuntu0.4"
          },
          {
            "binary_name": "libheif-plugin-jpegenc",
            "binary_version": "1.20.2-1ubuntu0.4"
          },
          {
            "binary_name": "libheif-plugin-kvazaar",
            "binary_version": "1.20.2-1ubuntu0.4"
          },
          {
            "binary_name": "libheif-plugin-libde265",
            "binary_version": "1.20.2-1ubuntu0.4"
          },
          {
            "binary_name": "libheif-plugin-rav1e",
            "binary_version": "1.20.2-1ubuntu0.4"
          },
          {
            "binary_name": "libheif-plugin-svtenc",
            "binary_version": "1.20.2-1ubuntu0.4"
          },
          {
            "binary_name": "libheif-plugin-x265",
            "binary_version": "1.20.2-1ubuntu0.4"
          },
          {
            "binary_name": "libheif-plugins-all",
            "binary_version": "1.20.2-1ubuntu0.4"
          },
          {
            "binary_name": "libheif1",
            "binary_version": "1.20.2-1ubuntu0.4"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:25.10",
        "name": "libheif",
        "purl": "pkg:deb/ubuntu/libheif@1.20.2-1ubuntu0.4?arch=source\u0026distro=questing"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.20.2-1ubuntu0.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.19.7-1",
        "1.19.8-1",
        "1.20.2-1",
        "1.20.2-1ubuntu0.1",
        "1.20.2-1ubuntu0.3"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "heif-gdk-pixbuf",
            "binary_version": "1.21.2-3ubuntu0.1"
          },
          {
            "binary_name": "heif-thumbnailer",
            "binary_version": "1.21.2-3ubuntu0.1"
          },
          {
            "binary_name": "heif-view",
            "binary_version": "1.21.2-3ubuntu0.1"
          },
          {
            "binary_name": "libheif-examples",
            "binary_version": "1.21.2-3ubuntu0.1"
          },
          {
            "binary_name": "libheif-plugin-aomdec",
            "binary_version": "1.21.2-3ubuntu0.1"
          },
          {
            "binary_name": "libheif-plugin-aomenc",
            "binary_version": "1.21.2-3ubuntu0.1"
          },
          {
            "binary_name": "libheif-plugin-dav1d",
            "binary_version": "1.21.2-3ubuntu0.1"
          },
          {
            "binary_name": "libheif-plugin-ffmpegdec",
            "binary_version": "1.21.2-3ubuntu0.1"
          },
          {
            "binary_name": "libheif-plugin-j2kdec",
            "binary_version": "1.21.2-3ubuntu0.1"
          },
          {
            "binary_name": "libheif-plugin-j2kenc",
            "binary_version": "1.21.2-3ubuntu0.1"
          },
          {
            "binary_name": "libheif-plugin-jpegdec",
            "binary_version": "1.21.2-3ubuntu0.1"
          },
          {
            "binary_name": "libheif-plugin-jpegenc",
            "binary_version": "1.21.2-3ubuntu0.1"
          },
          {
            "binary_name": "libheif-plugin-kvazaar",
            "binary_version": "1.21.2-3ubuntu0.1"
          },
          {
            "binary_name": "libheif-plugin-libde265",
            "binary_version": "1.21.2-3ubuntu0.1"
          },
          {
            "binary_name": "libheif-plugin-rav1e",
            "binary_version": "1.21.2-3ubuntu0.1"
          },
          {
            "binary_name": "libheif-plugin-svtenc",
            "binary_version": "1.21.2-3ubuntu0.1"
          },
          {
            "binary_name": "libheif-plugin-x265",
            "binary_version": "1.21.2-3ubuntu0.1"
          },
          {
            "binary_name": "libheif-plugins-all",
            "binary_version": "1.21.2-3ubuntu0.1"
          },
          {
            "binary_name": "libheif1",
            "binary_version": "1.21.2-3ubuntu0.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "libheif",
        "purl": "pkg:deb/ubuntu/libheif@1.21.2-3ubuntu0.1?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.21.2-3ubuntu0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.20.2-1",
        "1.20.2-2",
        "1.20.2-2build1",
        "1.20.2-2build2",
        "1.20.2-2ubuntu1",
        "1.21.2-1",
        "1.21.2-3"
      ]
    }
  ],
  "aliases": [],
  "details": "libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.21.2 and prior contain a heap-buffer-overflow (write) vulnerability in the grid tile compositing, allowing an attacker to write 64 bytes of fully attacker-controlled data past the end of a chroma plane heap allocation by crafting a HEIF/AVIF file with a 1\u00d74 grid of odd-height tiles. The overflow is triggered during normal image decoding with default build configuration. The written bytes are chroma (Cb/Cr) pixel values from the attacking tile, giving the attacker full control over the overflow content. This issue has been fixed in version 1.22.0.",
  "id": "UBUNTU-CVE-2026-32740",
  "modified": "2026-06-30T16:20:54Z",
  "published": "2026-05-19T20:16:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-32740"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-32740"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/strukturag/libheif/releases/tag/v1.22.0"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/strukturag/libheif/security/advisories/GHSA-frfr-f3vg-2g6j"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-8454-1"
    }
  ],
  "related": [
    "USN-8454-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-32740"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-32740 (GCVE-0-2026-32740)

FKIE_CVE-2026-32740

SUSE-SU-2026:22153-1

ubuntu-cve-2026-32740

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature