CVE-2026-32882
What it is
libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.21.2 and prior contain a heap buffer over-read in HeifPixelImage::overlay() in libheif/pixelimage.cc. When compositing an overlay image (iovl) whose child image has a different bit depth for the alpha channel than for the color channels, the function indexes into the alpha plane using the color channel stride (in_stride) instead of the previously retrieved alpha_stride, causing reads past the end of the alpha buffer (up to 3,123 bytes for a 100×50 image with 10-bit color and 8-bit alpha). A crafted HEIF file can exploit this to cause a denial of service (crash) or potentially disclose adjacent heap memory through leaked bytes embedded in the decoded output pixels. This issue has been fixed in versionThis issue has been fixed in version 1.22.0.
At a glance
- Exploitability
- Can be exploited over the network without logging in, but needs a user to act. High risk of service disruption.
- Exploit odds
- 0.7% chance of exploitation in the next 30 days (EPSS).
- Fix
- A patch, advisory or fixed version is referenced. Upgrade or apply it.
Timeline
- PublishedDisclosed publicly on CVE.org and NVD
- Last updatedMost recent change to the record
Why it ranks here
- Exploited in the wild: no, CISA does not list it.
- Exploit odds: 0.7% in the next 30 days (EPSS).
- Severity: 7.1 HIGH (CVSS).
- Fix: a patch or advisory is linked.
Details
- Published
- Last modified
- Exploit probability
- 0.7% · EPSS, next 30 days
- Weakness
- CWE-125 · Out-of-bounds read
- Record status
- Deferred
Attack profile CVSS 3.1 · 7.1
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Scope
- Unchanged
- Confidentiality
- Low
- Integrity
- None
- Availability
- High
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Is it in your code?
Hand this to your coding agent. It searches your project for the affected products and checks versions. Nothing leaves your machine.
Read https://cve-list.com/agent/cve/CVE-2026-32882.md and follow it. Check whether this project is affected by CVE-2026-32882. Read only. Don't change anything and don't upload my code. Tell me yes, no or not sure, with the file as proof.
Fix and advisories
- https://github.com/strukturag/libheif/releases/tag/v1.22.0
- https://github.com/strukturag/libheif/security/advisories/GHSA-hg7q-rjr2-8x46
- https://github.com/strukturag/libheif/security/advisories/GHSA-hg7q-rjr2-8x46
References
- https://github.com/strukturag/libheif/releases/tag/v1.22.0
- https://github.com/strukturag/libheif/security/advisories/GHSA-hg7q-rjr2-8x46
- https://access.redhat.com/security/cve/CVE-2026-32882
- https://bugzilla.redhat.com/show_bug.cgi?id=2480000
- https://github.com/strukturag/libheif/security/advisories/GHSA-hg7q-rjr2-8x46
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32882.json