CVE-2026-32882

libheif: Heap Buffer OOB Read in overlay compositing due to wrong alpha stride

No known exploitation. EPSS puts it in the 34th percentile. No fix published yet.

CVSS 3.17.1High EPSS percentile34th0.4% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixNone yetNo fix or workaround published

Published 2026-05-19Updated 2026-07-24Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Steps

Written by AI from the record

Check whether your applications, servers, scanners, or image tools use libheif 1.21.2 or earlier.
Upgrade libheif to version 1.22.0.
Until upgraded, block or quarantine HEIF files from untrusted senders before they are opened or processed.
Review recent crashes and unexpected output from software that processes HEIF images.

May need vendor or contractor work

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.21.2 and prior contain a heap buffer over-read in HeifPixelImage::overlay() in libheif/pixelimage.cc. When compositing an overlay image (iovl) whose child image has a different bit depth for the alpha channel than for the color channels, the function indexes into the alpha plane using the color channel stride (in_stride) instead of the previously retrieved alpha_stride, causing reads past the end of the alpha buffer (up to 3,123 bytes for a 100×50 image with 10-bit color and 8-bit alpha). A crafted HEIF file can exploit this to cause a denial of service (crash) or potentially disclose adjacent heap memory through leaked bytes embedded in the decoded output pixels. This issue has been fixed in versionThis issue has been fixed in version 1.22.0.

In plain language

Written by AI from the record

libheif 1.21.2 and earlier can be tricked by a malicious image file into crashing software or exposing small amounts of memory, so businesses that open untrusted HEIF images should act urgently.

CWE-125 heap buffer over-read in libheif overlay compositing occurs when a crafted HEIF file uses an alpha channel with a different bit depth from its color channels, causing the wrong stride to index the alpha buffer.

If you're affected

Image-processing service crashes
Small memory-data exposure
Interrupted file-processing workflows

What is it

This is a flaw in the software many applications use to open and process HEIF and AVIF images. A specially made image can make the software look beyond the data it should use—like a clerk accidentally reading the next customer’s paperwork while handling the current file.

Who is affected

This matters to you if software you use or run relies on libheif to open, convert, preview, scan, or process HEIF images. It is a risk when that software processes a specially crafted HEIF file from an attacker; the attacker does not need an account, but someone or something must open the file.

How urgent is it

An attacker can send a crafted image that causes affected software to crash or disclose nearby memory when it is processed, so this is a red-priority issue. There is no confirmed real-world exploitation or public exploit code, but the flaw is reachable in normal configurations and should be addressed promptly.

What to do — in detail

Inventory applications and services linked with or bundling libheif, including image upload pipelines, document scanners, media converters, desktop image viewers, and server-side thumbnail generators.
Confirm the installed library version and identify any deployment using version 1.21.2 or earlier.
Upgrade to libheif 1.22.0 or a vendor-provided package that incorporates that version; test image conversion and thumbnail workflows before broad deployment because library upgrades can affect dependent applications.
If upgrading is delayed, prevent untrusted HEIF uploads or attachments from reaching libheif-based processing, or convert them in an isolated, disposable environment.
Monitor application and service logs for crashes, decoding failures, unusual HEIF files, and unexpected image-processing output. CISA has not added this CVE to KEV, so there is no CISA remediation due date.

Technical context

CVE-2026-32882 is CVSS 7.1 High (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H), CWE-125. A network-delivered crafted HEIF file triggers a heap out-of-bounds read in overlay compositing when the overlay alpha plane has a different bit depth than color channels; the code uses the color stride rather than alpha_stride. Authentication is not required, while user interaction is required because a target application must decode the file. No public exploit code is recorded, and reporting describes coordinated security research rather than a confirmed real-world attack. CISA KEV does not list this CVE. EPSS is 0.3% (27th percentile) with a flat trend.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS34th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.4% chance of exploitation activity in the next 30 days, which ranks it in the 34th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Attention now

Sustained, driven by in-the-wild reports.

Lifecycle

7 events over 66 days, from the signal feeds we watch.

2026-07-24Record updated
2026-07-15Record updated
2026-06-30Record updated
2026-06-25OpenVAS check added
2026-05-19Publishedweakness classified, att&ck mapped

Affected products

strukturagoss-projectaka libde265, libheif, strukturag/libde265
- libheifLibraryOSS Libraries / generic-library

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

Scored 7.1 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction RequiredA user must click a link, open a file, or perform some action

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality LowSome restricted information is disclosed, but limited in scope
Integrity NoneNo integrity impact
Availability HighTotal denial of service — the component is completely unavailable