CVE-2026-32814 — libheif is a HEIF and AVIF file format decoder and encoder.

title: Potential Heap Memory Leak via Crafted HEIF/AVIF File Decoding - CVE-2026-32814
id: scw-2026-05-19-ai-1
status: experimental
level: medium
description: |
  Detects processes that are attempting to decode HEIF or AVIF files, which could be an indicator of exploitation for CVE-2026-32814. The vulnerability allows for heap memory information leaks when decoding a crafted grid image with strict_decoding=false. This rule specifically looks for the libheif library being invoked with HEIF/AVIF file extensions, a common pattern for exploitation.
author: SCW Feed Engine (AI-generated)
date: 2026-05-19
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-32814/
tags:
  - attack.initial_access
  - attack.t1190
logsource:
    category: process_creation
detection:
  selection:
      Image|contains:
          - 'libheif'
      CommandLine|contains:
          - '.heic'
          - '.avif'
      condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse