CVE-2026-32738

libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and below, a crafted 792-byte HEIF sequence file with samples_per_chunk=0 in the stsc box causes an unsigned integer underflow in the Chunk constructor (m_last_sample = 0 + 0 - 1 = UINT32_MAX), mapping all samples to an empty chunk and resulting in a denial of service. When any sample is accessed, the library reads from index 0 of an empty std::vector, causing a guaranteed SEGV (null-page read). The file parses successfully without producing an error; the crash occurs on the first frame access. This issue has been fixed in version 1.22.0.

libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and below, a crafted 792-byte HEIF sequence file with samples_per_chunk=0 in the stsc box causes an unsigned integer underflow in the Chunk constructor (m_last_sample = 0 + 0 - 1 = UINT32_MAX), mapping all samples to an empty chunk and resulting in a denial of service. When any sample is accessed, the library reads from index 0 of an empty std::vector, causing a guaranteed SEGV (null-page read). The file parses successfully without producing an error; the crash occurs on the first frame access. This issue has been fixed in version 1.22.0.

Root has patched CVE-2026-32738 in the libheif package for Root:Debian:12. Multiple fixed versions available.

Root has patched CVE-2026-32738 in the libheif package for Root:Debian:13. Multiple fixed versions available.

libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and below, a crafted 792-byte HEIF sequence file with samples_per_chunk=0 in the stsc box causes an unsigned integer underflow in the Chunk constructor (m_last_sample = 0 + 0 - 1 = UINT32_MAX), mapping all samples to an empty chunk and resulting in a denial of service. When any sample is accessed, the library reads from index 0 of an empty std::vector, causing a guaranteed SEGV (null-page read). The file parses successfully without producing an error; the crash occurs on the first frame access. This issue has been fixed in version 1.22.0.

libheif has a Heap OOB Read/SEGV Crash via Zero samples_per_chunk. (CVE-2026-32738) libheif is Vulnerable to Infinite Loop DoS via stts Sample Duration Lookup. (CVE-2026-32739) Heap-Buffer-Overflow Write in Grid Tile Chroma Compositing. (CVE-2026-32740) libheif has a heap buffer overflow in decode_mask_image(). (CVE-2026-32741) Uninitialized Heap Memory Information Leak via Failed Grid Tiles. (CVE-2026-32814) Heap Buffer OOB Read in overlay compositing due to wrong alpha stride. (CVE-2026-32882) strukturag libheif stsz/stts track.cc load out-of-bounds. (CVE-2026-3950) libheif allows Out-of-bounds vector access leading to invalid dereference (DoS). (CVE-2026-41069) Heap buffer over-read in SampleAuxInfoReader via crafted HEIF sequence file with mismatched saiz sample count. (CVE-2026-41071) A critical heap-based buffer overflow vulnerability exists in libheif v1.21.2 (and likely earlier versions) within the handling of uncompressed HEIF images (ISO/IEC 23001-17, unci item type). When processing a tiled image with chroma subsampling (e.g., 4:2:0 or 4:2:2), the library fails to scale spatial offsets for the chroma planes. This leads to out-of-bounds memory writes when decoding any tile other than the top-left one, potentially resulting in remote code execution. (CVE-2026-47178) Wrapped icef compressed-unit range check causes out-of-bounds read in uncompressed HEIF decoder. (CVE-2026-49271)

These are all security issues fixed in the gdk-pixbuf-loader-libheif-1.22.2-1.1 package on the GA media of openSUSE Tumbleweed.

This update for libheif fixes the following issues

Update to 1.23.0:

• CVE-2025-68431: heap buffer over-read in HeifPixelImage: overlay() via crafted HEIF that exercises the overlay image item (bsc#1255735).

• CVE-2026-3949: manipulation of the argument size of a malicious frame can lead to out-of-bounds read (bsc#1259541).

• CVE-2026-3950: manipulation of the component stsz/stts can lead to out-of-bounds read (bsc#1259544).

• CVE-2026-32738: Heap OOB Read / SEGV Crash via Zero samples_per_chunk in stsc (bsc#1265874).

• CVE-2026-32739: Infinite Loop DoS in stts Sample Duration Lookup (bsc#1265875).

• CVE-2026-32740: Heap-Buffer-Overflow Write in Grid Tile Chroma Compositing (bsc#1265876).

• CVE-2026-32741: heap buffer overflow in decode_mask_image() (bsc#1265877).

• CVE-2026-32814: Uninitialized Heap Memory Information Leak via Failed Grid Tiles (bsc#1265878).

• CVE-2026-32882: Heap Buffer OOB Read in overlay compositing due to wrong alpha stride (bsc#1265879).

• CVE-2026-41069: Out-of-bounds vector access leading to invalid dereference (bsc#1265979).

• CVE-2026-41071: Heap buffer over-read in SampleAuxInfoReader via crafted HEIF sequence file with mismatched saiz sample count (bsc#1265980).

• CVE-2026-47178: Heap Out Of Bounds Write in unci subsystem (bsc#1265981).

• CVE-2026-47247: Heap Information Disclosure via Grid Image Gap + Uninitialized Pixel Plane Allocation (bsc#1265982).

• CVE-2026-47251: integer overflow bypass in vvdec_push_data2 (bsc#1265983).

• CVE-2026-47254: Heap Buffer Overflow in Track: get_next_sample_raw_data() -- OOB Chunk Vector Access (bsc#1265987).

• CVE-2026-47709: NULL pointer dereference in heif_image_handle_get_image_tiling for malformed unci image missing ispe (bsc#1265988).

• CVE-2026-47714: Integer overflow in inline mask size calculation causes undersized buffer allocation (bsc#1265989).

• CVE-2026-48029: heap OOB read in ImageItem_Grid: decode_grid_tile via irot-induced tile-coordinate underflow (bsc#1265990).

• CVE-2026-49271: Wrapped icef compressed-unit range check causes out-of-bounds read in uncompressed HEIF decoder (bsc#1266282).

• CVE-2026-50142: unbounded heap allocation in HEIF sequence parser (bsc#1267455).

• Heap buffer overflow via uint32_t stride overflow in image plane allocation (+ 2 additional instances) (bsc#1265997).

• Incorrect byte-count initialization in BitstreamRange constructor allows container-boundary check bypass (bsc#1265995).

• Integer Overflow in SampleAuxInfoReader Offset Calculation (bsc#1265992).

• Out-of-bounds read and assertion-based DoS in EXIF parsing (find_exif_tag / read32) with short EXIF TIFF payload (bsc#1265996).

• Out-of-bounds write in inline mask region API when source mask exceeds declared region (bsc#1266281).

• update to 1.23.0:

• add API functions to read and write metadata: ambient viewing environment nominal diffuse white luminance

• update to 1.22.2:

• adds a output_image_nclx_profile_passthrough option to heif_decoding_options
• build issues with OpenJPEG plugin (#1813)
• non-plain C in header (#1812)

• update to 1.22.0:

• This is a large release with substantial new functionality, mainly focusing on generalized image formats (e.g., multi- spectral images) and a reworked implementation of ISO/IEC 23001-17 (lossless image codec).
• HDR up to 64 bpp
• Multi-component images with arbitrary component layouts (multi-spectral images, arbitrary non-visual data)
• Filter-array (Bayer / mosaic) images, with debayering in color transformation pipeline
• Metadata: chroma-sample location (cloc), sample non- uniformity (snuc), sensor bad-pixel map (sbpm), polarization pattern (splz)
• heif-dec can now convert to WebP (thanks to @torusrxxx).
• heif-enc can now accept input from WebP, HEIF, pure raw files (including floating point pixel data), and CMYK JPEG (converted to RGB).
• TIFF input can now read many TIFF formats used in geospatial imaging, like: 16-bit, signed integers, float samples, tiled TIFFs,…

This update for libheif fixes the following issues

Update to 1.23.0:

• CVE-2025-68431: heap buffer over-read in HeifPixelImage: overlay() via crafted HEIF that exercises the overlay image item (bsc#1255735).

• CVE-2026-3949: manipulation of the argument size of a malicious frame can lead to out-of-bounds read (bsc#1259541).

• CVE-2026-3950: manipulation of the component stsz/stts can lead to out-of-bounds read (bsc#1259544).

• CVE-2026-32738: Heap OOB Read / SEGV Crash via Zero samples_per_chunk in stsc (bsc#1265874).

• CVE-2026-32739: Infinite Loop DoS in stts Sample Duration Lookup (bsc#1265875).

• CVE-2026-32740: Heap-Buffer-Overflow Write in Grid Tile Chroma Compositing (bsc#1265876).

• CVE-2026-32741: heap buffer overflow in decode_mask_image() (bsc#1265877).

• CVE-2026-32814: Uninitialized Heap Memory Information Leak via Failed Grid Tiles (bsc#1265878).

• CVE-2026-32882: Heap Buffer OOB Read in overlay compositing due to wrong alpha stride (bsc#1265879).

• CVE-2026-41069: Out-of-bounds vector access leading to invalid dereference (bsc#1265979).

• CVE-2026-41071: Heap buffer over-read in SampleAuxInfoReader via crafted HEIF sequence file with mismatched saiz sample count (bsc#1265980).

• CVE-2026-47178: Heap Out Of Bounds Write in unci subsystem (bsc#1265981).

• CVE-2026-47247: Heap Information Disclosure via Grid Image Gap + Uninitialized Pixel Plane Allocation (bsc#1265982).

• CVE-2026-47251: integer overflow bypass in vvdec_push_data2 (bsc#1265983).

• CVE-2026-47254: Heap Buffer Overflow in Track: get_next_sample_raw_data() -- OOB Chunk Vector Access (bsc#1265987).

• CVE-2026-47709: NULL pointer dereference in heif_image_handle_get_image_tiling for malformed unci image missing ispe (bsc#1265988).

• CVE-2026-47714: Integer overflow in inline mask size calculation causes undersized buffer allocation (bsc#1265989).

• CVE-2026-48029: heap OOB read in ImageItem_Grid: decode_grid_tile via irot-induced tile-coordinate underflow (bsc#1265990).

• CVE-2026-49271: Wrapped icef compressed-unit range check causes out-of-bounds read in uncompressed HEIF decoder (bsc#1266282).

• CVE-2026-50142: unbounded heap allocation in HEIF sequence parser (bsc#1267455).

• Heap buffer overflow via uint32_t stride overflow in image plane allocation (+ 2 additional instances) (bsc#1265997).

• Incorrect byte-count initialization in BitstreamRange constructor allows container-boundary check bypass (bsc#1265995).

• Integer Overflow in SampleAuxInfoReader Offset Calculation (bsc#1265992).

• Out-of-bounds read and assertion-based DoS in EXIF parsing (find_exif_tag / read32) with short EXIF TIFF payload (bsc#1265996).

• Out-of-bounds write in inline mask region API when source mask exceeds declared region (bsc#1266281).

• update to 1.23.0:

• add API functions to read and write metadata: ambient viewing environment nominal diffuse white luminance

• update to 1.22.2:

• adds a output_image_nclx_profile_passthrough option to heif_decoding_options
• build issues with OpenJPEG plugin (#1813)
• non-plain C in header (#1812)

• update to 1.22.0:

• This is a large release with substantial new functionality, mainly focusing on generalized image formats (e.g., multi- spectral images) and a reworked implementation of ISO/IEC 23001-17 (lossless image codec).
• HDR up to 64 bpp
• Multi-component images with arbitrary component layouts (multi-spectral images, arbitrary non-visual data)
• Filter-array (Bayer / mosaic) images, with debayering in color transformation pipeline
• Metadata: chroma-sample location (cloc), sample non- uniformity (snuc), sensor bad-pixel map (sbpm), polarization pattern (splz)
• heif-dec can now convert to WebP (thanks to @torusrxxx).
• heif-enc can now accept input from WebP, HEIF, pure raw files (including floating point pixel data), and CMYK JPEG (converted to RGB).
• TIFF input can now read many TIFF formats used in geospatial imaging, like: 16-bit, signed integers, float samples, tiled TIFFs,…

This update for libheif fixes the following issues

Update to 1.23.0:

• CVE-2025-68431: heap buffer over-read in HeifPixelImage: overlay() via crafted HEIF that exercises the overlay image item (bsc#1255735).
• CVE-2026-3950: manipulation of the component stsz/stts can lead to out-of-bounds read (bsc#1259544).
• CVE-2026-32738: Heap OOB Read / SEGV Crash via Zero samples_per_chunk in stsc (bsc#1265874).
• CVE-2026-32739: Infinite Loop DoS in stts Sample Duration Lookup (bsc#1265875).
• CVE-2026-32740: Heap-Buffer-Overflow Write in Grid Tile Chroma Compositing (bsc#1265876).
• CVE-2026-32741: heap buffer overflow in decode_mask_image() (bsc#1265877).
• CVE-2026-32814: Uninitialized Heap Memory Information Leak via Failed Grid Tiles (bsc#1265878).
• CVE-2026-32882: Heap Buffer OOB Read in overlay compositing due to wrong alpha stride (bsc#1265879).
• CVE-2026-41069: Out-of-bounds vector access leading to invalid dereference (bsc#1265979).
• CVE-2026-41071: Heap buffer over-read in SampleAuxInfoReader via crafted HEIF sequence file with mismatched saiz sample count (bsc#1265980).
• CVE-2026-47178: Heap Out Of Bounds Write in unci subsystem (bsc#1265981).
• CVE-2026-47247: Heap Information Disclosure via Grid Image Gap + Uninitialized Pixel Plane Allocation (bsc#1265982).
• CVE-2026-47251: integer overflow bypass in vvdec_push_data2 (bsc#1265983).
• CVE-2026-47254: Heap Buffer Overflow in Track: get_next_sample_raw_data() -- OOB Chunk Vector Access (bsc#1265987).
• CVE-2026-47709: NULL pointer dereference in heif_image_handle_get_image_tiling for malformed unci image missing ispe (bsc#1265988).
• CVE-2026-47714: Integer overflow in inline mask size calculation causes undersized buffer allocation (bsc#1265989).
• CVE-2026-48029: heap OOB read in ImageItem_Grid: decode_grid_tile via irot-induced tile-coordinate underflow (bsc#1265990).
• CVE-2026-49271: Wrapped icef compressed-unit range check causes out-of-bounds read in uncompressed HEIF decoder (bsc#1266282).
• CVE-2026-50142: unbounded heap allocation in HEIF sequence parser (bsc#1267455).
• Heap buffer overflow via uint32_t stride overflow in image plane allocation (+ 2 additional instances) (bsc#1265997).
• Incorrect byte-count initialization in BitstreamRange constructor allows container-boundary check bypass (bsc#1265995).
• Integer Overflow in SampleAuxInfoReader Offset Calculation (bsc#1265992).
• Out-of-bounds read and assertion-based DoS in EXIF parsing (find_exif_tag / read32) with short EXIF TIFF payload (bsc#1265996).
• Out-of-bounds write in inline mask region API when source mask exceeds declared region (bsc#1266281).

Changes for libheif:

• version update to 1.23.0:

• add API functions to read and write metadata: ambient viewing environment nominal diffuse white luminance
• adds a output_image_nclx_profile_passthrough option to heif_decoding_options
• CVE-2026-50142 (GHSA-jvmp-j3cw-84mh) - unbounded heap allocation in HEIF sequence parser (stsz fixed-size mode missing bound check)

• version update to 1.22.2:

• build issues with OpenJPEG plugin (#1813)
• non-plain C in header (#1812)
• CVE-2026-49271 (GHSA-r7qj-cg5r-r6vf) - Wrapped icef compressed-unit range check causes out-of-bounds read in uncompressed HEIF decoder
• CVE TBD (GHSA-5hqq-636x-r3cr) - Out-of-bounds write in inline mask region API when source mask exceeds declared region

• update to 1.22.0:

• This is a large release with substantial new functionality, mainly focusing on generalized image formats (e.g., multi- spectral images) and a reworked implementation of ISO/IEC 23001-17 (lossless image codec).
• HDR up to 64 bpp
• Multi-component images with arbitrary component layouts (multi-spectral images, arbitrary non-visual data)
• Filter-array (Bayer / mosaic) images, with debayering in color transformation pipeline
• Metadata: chroma-sample location (cloc), sample non- uniformity (snuc), sensor bad-pixel map (sbpm), polarization pattern (splz)
• heif-dec can…

Elhanan Haenel discovered that libheif incorrectly handled certain malformed HEIF sequence files. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 25.10 and Ubuntu 26.04 LTS. (CVE-2026-32738)

Elhanan Haenel discovered that libheif incorrectly handled certain malformed HEIF sequence files, leading to an infinite loop. An attacker could possibly use this issue to cause libheif to use excessive resources, resulting in a denial of service. This issue only affected Ubuntu 25.10 and Ubuntu 26.04 LTS. (CVE-2026-32739)

Elhanan Haenel discovered that libheif incorrectly handled certain crafted HEIF/AVIF image files. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 25.10 and Ubuntu 26.04 LTS. (CVE-2026-32740)

It was discovered that libheif incorrectly handled certain crafted HEIF files containing mask images. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 24.04 LTS, Ubuntu 25.10, and Ubuntu 26.04 LTS. (CVE-2026-32741)

It was discovered that libheif incorrectly handled certain crafted grid-based HEIF/AVIF files. An attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 25.10, and Ubuntu 26.04 LTS. (CVE-2026-32814)

It was discovered that libheif incorrectly handled certain crafted HEIF files when compositing overlay images. An attacker could possibly use this issue to cause a denial of service or obtain sensitive information. (CVE-2026-32882)

It was discovered that libheif incorrectly handled certain crafted files. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 25.10 and Ubuntu 26.04 LTS. (CVE-2026-3950)

It was discovered that libheif incorrectly handled certain malformed HEIF sequence files. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 25.10 and Ubuntu 26.04 LTS. (CVE-2026-41069)

It was discovered that libheif incorrectly handled certain crafted HEIF sequence files. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 25.10 and Ubuntu 26.04 LTS. (CVE-2026-41071)