libheif Heap-Buffer-Overflow (CVE-2026-32740) Exposes Image Processing Stacks

The National Vulnerability Database has detailed CVE-2026-32740, a critical heap-buffer-overflow (write) vulnerability within libheif, a widely used HEIF and AVIF file format decoder and encoder. Versions 1.21.2 and prior are affected. This flaw permits an attacker to write 64 bytes of fully controlled data past the end of a chroma plane heap allocation. The attack vector involves crafting a malicious HEIF/AVIF file with a specific 1x4 grid of odd-height tiles.

The overflow is triggered during normal image decoding, even with default build configurations, making exploitation straightforward. The written bytes are chroma pixel values directly from the attacking tile, granting the attacker precise control over the overflow content. This isn’t just a crash; it’s a controlled write, which significantly increases the exploitability for remote code execution. The National Vulnerability Database assigns this a CVSS score of 8.8 (HIGH), underscoring the severity.

This vulnerability highlights a critical risk in media processing pipelines. Any application, service, or system that ingests and decodes HEIF or AVIF files using vulnerable versions of libheif is at risk. Defenders must recognize that attackers will leverage file formats like these to bypass traditional perimeter defenses, embedding exploits within seemingly innocuous image files. The fix is available in libheif version 1.22.0.