Every CVE Search/ Get API key

CVE-2026-32814

libheif: Uninitialized Heap Memory Information Leak via Failed Grid Tiles

6.5 MediumFix available

libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, when decoding a HEIF grid image with strict_decoding=false (the default), a corrupted tile silently fails to decode and the library returns heif_error_Ok with no indication of failure, leading to an uninitialized heap memory information leak. The canvas is allocated via create_clone_image_at_new_size() → plane.alloc() → new (std::nothrow) uint8_t[allocation_size] which does not zero the memory; only the alpha plane is explicitly initialized via fill_plane(), so the Y, Cb, and Cr planes contain whatever was previously at that heap address. The failed tile's region of the canvas is never written. It retains uninitialized heap data that is delivered to the caller as decoded pixel values (4,096 bytes per Y/Cb/Cr plane = 12,288+ bytes total). Any application using libheif to decode grid-based HEIF/AVIF files with default settings is vulnerable: a crafted .heic or .avif file causes 4,096+ bytes of heap memory to appear as pixel values in the decoded image, and the calling application receives heif_error_Ok, so it has no indication the output contains heap garbage. In server-side image processing, an uploaded crafted HEIF decoded and re-encoded (e.g., as PNG/JPEG for thumbnails, CDN, social media) can leak cross-user data such as auth tokens, database results, and other users' image data. This issue has been fixed in version 1.22.0.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

0.31%Up 0.3 points since May 20, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.5

libheif: Uninitialized Heap Memory Information Leak via Failed Grid Tiles

libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, when decoding a HEIF grid image with strict_decoding=false (the default), a corrupted tile silently fails to decode and the library returns heif_error_Ok with no indication of failure, leading to an uninitialized heap memory information leak. The canvas is allocated via create_clone_image_at_new_size() → plane.alloc() → new (std::nothrow) uint8_t[allocation_size] which does not zero the memory; only the alpha plane is explicitly initialized via fill_plane(), so the Y, Cb, and Cr planes contain whatever was previously at that heap address. The failed tile's region of the canvas is never written. It retains uninitialized heap data that is delivered to the caller as decoded pixel values (4,096 bytes per Y/Cb/Cr plane = 12,288+ bytes total). Any application using libheif to decode grid-based HEIF/AVIF files with default settings is vulnerable: a crafted .heic or .avif file causes 4,096+ bytes of heap memory to appear as pixel values in the decoded image, and the calling application receives heif_error_Ok, so it has no indication the output contains heap garbage. In server-side image processing, an uploaded crafted HEIF decoded and re-encoded (e.g., as PNG/JPEG for thumbnails, CDN, social media) can leak cross-user data such as auth tokens, database results, and other users' image data. This issue has been fixed in version 1.22.0.

Record
CVE-2026-32814
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Weakness
CWE-200, CWE-908
Updated
2026-11-02
EUVDEUVD-2026-30980 6.5

libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, when decoding a HEIF grid image with strict_decoding=false (the default), a corrupted tile silently fails to decode and the library returns heif_error_Ok with no indication of failure, leading to an uninitialized heap memory information leak. The canvas is allocated via create_clone_image_at_new_size() → plane.alloc() → new (std::nothrow) uint8_t[allocation_size] which does not zero the memory; only the alpha plane is explicitly initialized via fill_plane(), so the Y, Cb, and Cr planes contain whatever was previously at that heap address. The failed tile's region of the canvas is never written. It retains uninitialized heap data that is delivered to the caller as decoded pixel values (4,096 bytes per Y/Cb/Cr plane = 12,288+ bytes total). Any application using libheif to decode grid-based HEIF/AVIF files with default settings is vulnerable: a crafted .heic or .avif file causes 4,096+ bytes of heap memory to appear as pixel values in the decoded image, and the calling application receives heif_error_Ok, so it has no indication the output contains heap garbage. In server-side image processing, an uploaded crafted HEIF decoded and re-encoded (e.g., as PNG/JPEG for thumbnails, CDN, social media) can leak cross-user data such as auth tokens, database results, and other users' image data. This issue has been fixed in version 1.22.0.

Record
EUVD-2026-30980
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Updated
2026-11-02
NVD 6.5

libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, when decoding a HEIF grid image with strict_decoding=false (the default), a corrupted tile silently fails to decode and the library returns heif_error_Ok with no indication of failure, leading to an uninitialized heap memory information leak. The canvas is allocated via create_clone_image_at_new_size() → plane.alloc() → new (std::nothrow) uint8_t[allocation_size] which does not zero the memory; only the alpha plane is explicitly initialized via fill_plane(), so the Y, Cb, and Cr planes contain whatever was previously at that heap address. The failed tile's region of the canvas is never written. It retains uninitialized heap data that is delivered to the caller as decoded pixel values (4,096 bytes per Y/Cb/Cr plane = 12,288+ bytes total). Any application using libheif to decode grid-based HEIF/AVIF files with default settings is vulnerable: a crafted .heic or .avif file causes 4,096+ bytes of heap memory to appear as pixel values in the decoded image, and the calling application receives heif_error_Ok, so it has no indication the output contains heap garbage. In server-side image processing, an uploaded crafted HEIF decoded and re-encoded (e.g., as PNG/JPEG for thumbnails, CDN, social media) can leak cross-user data such as auth tokens, database results, and other users' image data. This issue has been fixed in version 1.22.0.

Record
CVE-2026-32814
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Weakness
CWE-200, CWE-908
Updated
2026-11-02
OSVBELL-CVE-2026-32814 6.5
Record
BELL-CVE-2026-32814
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSV 6.5

libheif: Uninitialized Heap Memory Information Leak via Failed Grid Tiles

libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, when decoding a HEIF grid image with strict_decoding=false (the default), a corrupted tile silently fails to decode and the library returns heif_error_Ok with no indication of failure, leading to an uninitialized heap memory information leak. The canvas is allocated via create_clone_image_at_new_size() → plane.alloc() → new (std::nothrow) uint8_t[allocation_size] which does not zero the memory; only the alpha plane is explicitly initialized via fill_plane(), so the Y, Cb, and Cr planes contain whatever was previously at that heap address. The failed tile's region of the canvas is never written. It retains uninitialized heap data that is delivered to the caller as decoded pixel values (4,096 bytes per Y/Cb/Cr plane = 12,288+ bytes total). Any application using libheif to decode grid-based HEIF/AVIF files with default settings is vulnerable: a crafted .heic or .avif file causes 4,096+ bytes of heap memory to appear as pixel values in the decoded image, and the calling application receives heif_error_Ok, so it has no indication the output contains heap garbage. In server-side image processing, an uploaded crafted HEIF decoded and re-encoded (e.g., as PNG/JPEG for thumbnails, CDN, social media) can leak cross-user data such as auth tokens, database results, and other users' image data. This issue has been fixed in version 1.22.0.

Record
CVE-2026-32814
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Weakness
CWE-200, CWE-908
Updated
2026-11-02
OSVDEBIAN-CVE-2026-32814 6.5

libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, when decoding a HEIF grid image with strict_decoding=false (the default), a corrupted tile silently fails to decode and the library returns heif_error_Ok with no indication of failure, leading to an uninitialized heap memory information leak. The canvas is allocated via create_clone_image_at_new_size() → plane.alloc() → new (std::nothrow) uint8_t[allocation_size] which does not zero the memory; only the alpha plane is explicitly initialized via fill_plane(), so the Y, Cb, and Cr planes contain whatever was previously at that heap address. The failed tile's region of the canvas is never written. It retains uninitialized heap data that is delivered to the caller as decoded pixel values (4,096 bytes per Y/Cb/Cr plane = 12,288+ bytes total). Any application using libheif to decode grid-based HEIF/AVIF files with default settings is vulnerable: a crafted .heic or .avif file causes 4,096+ bytes of heap memory to appear as pixel values in the decoded image, and the calling application receives heif_error_Ok, so it has no indication the output contains heap garbage. In server-side image processing, an uploaded crafted HEIF decoded and re-encoded (e.g., as PNG/JPEG for thumbnails, CDN, social media) can leak cross-user data such as auth tokens, database results, and other users' image data. This issue has been fixed in version 1.22.0.

Record
DEBIAN-CVE-2026-32814
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Updated
2026-11-02
Show 9 moreShow less
OSVROOT-OS-DEBIAN-11-CVE-2026-32814 6.5

CVE-2026-32814 in libheif - Patched by Root

Root has patched CVE-2026-32814 in the libheif package for Root:Debian:11. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-11-CVE-2026-32814
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVROOT-OS-DEBIAN-12-CVE-2026-32814 6.5

CVE-2026-32814 in libheif - Patched by Root

Root has patched CVE-2026-32814 in the libheif package for Root:Debian:12. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-12-CVE-2026-32814
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Updated
2026-11-03
OSVROOT-OS-DEBIAN-13-CVE-2026-32814 6.5

CVE-2026-32814 in libheif - Patched by Root

Root has patched CVE-2026-32814 in the libheif package for Root:Debian:13. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-13-CVE-2026-32814
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-32814 6.5

libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, when decoding a HEIF grid image with strict_decoding=false (the default), a corrupted tile silently fails to decode and the library returns heif_error_Ok with no indication of failure, leading to an uninitialized heap memory information leak. The canvas is allocated via create_clone_image_at_new_size() → plane.alloc() → new (std::nothrow) uint8_t[allocation_size] which does not zero the memory; only the alpha plane is explicitly initialized via fill_plane(), so the Y, Cb, and Cr planes contain whatever was previously at that heap address. The failed tile's region of the canvas is never written. It retains uninitialized heap data that is delivered to the caller as decoded pixel values (4,096 bytes per Y/Cb/Cr plane = 12,288+ bytes total). Any application using libheif to decode grid-based HEIF/AVIF files with default settings is vulnerable: a crafted .heic or .avif file causes 4,096+ bytes of heap memory to appear as pixel values in the decoded image, and the calling application receives heif_error_Ok, so it has no indication the output contains heap garbage. In server-side image processing, an uploaded crafted HEIF decoded and re-encoded (e.g., as PNG/JPEG for thumbnails, CDN, social media) can leak cross-user data such as auth tokens, database results, and other users' image data. This issue has been fixed in version 1.22.0.

Record
UBUNTU-CVE-2026-32814
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVMGASA-2026-0247 No score

Updated libheif packages fix security vulnerabilities

libheif has a Heap OOB Read/SEGV Crash via Zero samples_per_chunk. (CVE-2026-32738) libheif is Vulnerable to Infinite Loop DoS via stts Sample Duration Lookup. (CVE-2026-32739) Heap-Buffer-Overflow Write in Grid Tile Chroma Compositing. (CVE-2026-32740) libheif has a heap buffer overflow in decode_mask_image(). (CVE-2026-32741) Uninitialized Heap Memory Information Leak via Failed Grid Tiles. (CVE-2026-32814) Heap Buffer OOB Read in overlay compositing due to wrong alpha stride. (CVE-2026-32882) strukturag libheif stsz/stts track.cc load out-of-bounds. (CVE-2026-3950) libheif allows Out-of-bounds vector access leading to invalid dereference (DoS). (CVE-2026-41069) Heap buffer over-read in SampleAuxInfoReader via crafted HEIF sequence file with mismatched saiz sample count. (CVE-2026-41071) A critical heap-based buffer overflow vulnerability exists in libheif v1.21.2 (and likely earlier versions) within the handling of uncompressed HEIF images (ISO/IEC 23001-17, unci item type). When processing a tiled image with chroma subsampling (e.g., 4:2:0 or 4:2:2), the library fails to scale spatial offsets for the chroma planes. This leads to out-of-bounds memory writes when decoding any tile other than the top-left one, potentially resulting in remote code execution. (CVE-2026-47178) Wrapped icef compressed-unit range check causes out-of-bounds read in uncompressed HEIF decoder. (CVE-2026-49271)

Record
MGASA-2026-0247
Updated
2026-11-02
OSVopenSUSE-SU-2026:10878-1 No score

gdk-pixbuf-loader-libheif-1.22.2-1.1 on GA media

These are all security issues fixed in the gdk-pixbuf-loader-libheif-1.22.2-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10878-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20974-1 No score

Security update for libheif

This update for libheif fixes the following issues

Update to 1.23.0:

  • CVE-2025-68431: heap buffer over-read in HeifPixelImage: overlay() via crafted HEIF that exercises the overlay image item (bsc#1255735).

  • CVE-2026-3949: manipulation of the argument size of a malicious frame can lead to out-of-bounds read (bsc#1259541).

  • CVE-2026-3950: manipulation of the component stsz/stts can lead to out-of-bounds read (bsc#1259544).

  • CVE-2026-32738: Heap OOB Read / SEGV Crash via Zero samples_per_chunk in stsc (bsc#1265874).

  • CVE-2026-32739: Infinite Loop DoS in stts Sample Duration Lookup (bsc#1265875).

  • CVE-2026-32740: Heap-Buffer-Overflow Write in Grid Tile Chroma Compositing (bsc#1265876).

  • CVE-2026-32741: heap buffer overflow in decode_mask_image() (bsc#1265877).

  • CVE-2026-32814: Uninitialized Heap Memory Information Leak via Failed Grid Tiles (bsc#1265878).

  • CVE-2026-32882: Heap Buffer OOB Read in overlay compositing due to wrong alpha stride (bsc#1265879).

  • CVE-2026-41069: Out-of-bounds vector access leading to invalid dereference (bsc#1265979).

  • CVE-2026-41071: Heap buffer over-read in SampleAuxInfoReader via crafted HEIF sequence file with mismatched saiz sample count (bsc#1265980).

  • CVE-2026-47178: Heap Out Of Bounds Write in unci subsystem (bsc#1265981).

  • CVE-2026-47247: Heap Information Disclosure via Grid Image Gap + Uninitialized Pixel Plane Allocation (bsc#1265982).

  • CVE-2026-47251: integer overflow bypass in vvdec_push_data2 (bsc#1265983).

  • CVE-2026-47254: Heap Buffer Overflow in Track: get_next_sample_raw_data() -- OOB Chunk Vector Access (bsc#1265987).

  • CVE-2026-47709: NULL pointer dereference in heif_image_handle_get_image_tiling for malformed unci image missing ispe (bsc#1265988).

  • CVE-2026-47714: Integer overflow in inline mask size calculation causes undersized buffer allocation (bsc#1265989).

  • CVE-2026-48029: heap OOB read in ImageItem_Grid: decode_grid_tile via irot-induced tile-coordinate underflow (bsc#1265990).

  • CVE-2026-49271: Wrapped icef compressed-unit range check causes out-of-bounds read in uncompressed HEIF decoder (bsc#1266282).

  • CVE-2026-50142: unbounded heap allocation in HEIF sequence parser (bsc#1267455).

  • Heap buffer overflow via uint32_t stride overflow in image plane allocation (+ 2 additional instances) (bsc#1265997).

  • Incorrect byte-count initialization in BitstreamRange constructor allows container-boundary check bypass (bsc#1265995).

  • Integer Overflow in SampleAuxInfoReader Offset Calculation (bsc#1265992).

  • Out-of-bounds read and assertion-based DoS in EXIF parsing (find_exif_tag / read32) with short EXIF TIFF payload (bsc#1265996).

  • Out-of-bounds write in inline mask region API when source mask exceeds declared region (bsc#1266281).

  • update to 1.23.0:

  • add API functions to read and write metadata: ambient viewing environment nominal diffuse white luminance
  • update to 1.22.2:
  • adds a output_image_nclx_profile_passthrough option to heif_decoding_options
  • build issues with OpenJPEG plugin (#1813)
  • non-plain C in header (#1812)
  • update to 1.22.0:
  • This is a large release with substantial new functionality, mainly focusing on generalized image formats (e.g., multi- spectral images) and a reworked implementation of ISO/IEC 23001-17 (lossless image codec).
  • HDR up to 64 bpp
  • Multi-component images with arbitrary component layouts (multi-spectral images, arbitrary non-visual data)
  • Filter-array (Bayer / mosaic) images, with debayering in color transformation pipeline
  • Metadata: chroma-sample location (cloc), sample non- uniformity (snuc), sensor bad-pixel map (sbpm), polarization pattern (splz)
  • heif-dec can now convert to WebP (thanks to @torusrxxx).
  • heif-enc can now accept input from WebP, HEIF, pure raw files (including floating point pixel data), and CMYK JPEG (converted to RGB).
  • TIFF input can now read many TIFF formats used in geospatial imaging, like: 16-bit, signed integers, float samples, tiled TIFFs,…
Record
openSUSE-SU-2026:20974-1
Updated
2026-11-02
OSVSUSE-SU-2026:22153-1 No score

Security update for libheif

This update for libheif fixes the following issues

Update to 1.23.0:

  • CVE-2025-68431: heap buffer over-read in HeifPixelImage: overlay() via crafted HEIF that exercises the overlay image item (bsc#1255735).

  • CVE-2026-3949: manipulation of the argument size of a malicious frame can lead to out-of-bounds read (bsc#1259541).

  • CVE-2026-3950: manipulation of the component stsz/stts can lead to out-of-bounds read (bsc#1259544).

  • CVE-2026-32738: Heap OOB Read / SEGV Crash via Zero samples_per_chunk in stsc (bsc#1265874).

  • CVE-2026-32739: Infinite Loop DoS in stts Sample Duration Lookup (bsc#1265875).

  • CVE-2026-32740: Heap-Buffer-Overflow Write in Grid Tile Chroma Compositing (bsc#1265876).

  • CVE-2026-32741: heap buffer overflow in decode_mask_image() (bsc#1265877).

  • CVE-2026-32814: Uninitialized Heap Memory Information Leak via Failed Grid Tiles (bsc#1265878).

  • CVE-2026-32882: Heap Buffer OOB Read in overlay compositing due to wrong alpha stride (bsc#1265879).

  • CVE-2026-41069: Out-of-bounds vector access leading to invalid dereference (bsc#1265979).

  • CVE-2026-41071: Heap buffer over-read in SampleAuxInfoReader via crafted HEIF sequence file with mismatched saiz sample count (bsc#1265980).

  • CVE-2026-47178: Heap Out Of Bounds Write in unci subsystem (bsc#1265981).

  • CVE-2026-47247: Heap Information Disclosure via Grid Image Gap + Uninitialized Pixel Plane Allocation (bsc#1265982).

  • CVE-2026-47251: integer overflow bypass in vvdec_push_data2 (bsc#1265983).

  • CVE-2026-47254: Heap Buffer Overflow in Track: get_next_sample_raw_data() -- OOB Chunk Vector Access (bsc#1265987).

  • CVE-2026-47709: NULL pointer dereference in heif_image_handle_get_image_tiling for malformed unci image missing ispe (bsc#1265988).

  • CVE-2026-47714: Integer overflow in inline mask size calculation causes undersized buffer allocation (bsc#1265989).

  • CVE-2026-48029: heap OOB read in ImageItem_Grid: decode_grid_tile via irot-induced tile-coordinate underflow (bsc#1265990).

  • CVE-2026-49271: Wrapped icef compressed-unit range check causes out-of-bounds read in uncompressed HEIF decoder (bsc#1266282).

  • CVE-2026-50142: unbounded heap allocation in HEIF sequence parser (bsc#1267455).

  • Heap buffer overflow via uint32_t stride overflow in image plane allocation (+ 2 additional instances) (bsc#1265997).

  • Incorrect byte-count initialization in BitstreamRange constructor allows container-boundary check bypass (bsc#1265995).

  • Integer Overflow in SampleAuxInfoReader Offset Calculation (bsc#1265992).

  • Out-of-bounds read and assertion-based DoS in EXIF parsing (find_exif_tag / read32) with short EXIF TIFF payload (bsc#1265996).

  • Out-of-bounds write in inline mask region API when source mask exceeds declared region (bsc#1266281).

  • update to 1.23.0:

  • add API functions to read and write metadata: ambient viewing environment nominal diffuse white luminance
  • update to 1.22.2:
  • adds a output_image_nclx_profile_passthrough option to heif_decoding_options
  • build issues with OpenJPEG plugin (#1813)
  • non-plain C in header (#1812)
  • update to 1.22.0:
  • This is a large release with substantial new functionality, mainly focusing on generalized image formats (e.g., multi- spectral images) and a reworked implementation of ISO/IEC 23001-17 (lossless image codec).
  • HDR up to 64 bpp
  • Multi-component images with arbitrary component layouts (multi-spectral images, arbitrary non-visual data)
  • Filter-array (Bayer / mosaic) images, with debayering in color transformation pipeline
  • Metadata: chroma-sample location (cloc), sample non- uniformity (snuc), sensor bad-pixel map (sbpm), polarization pattern (splz)
  • heif-dec can now convert to WebP (thanks to @torusrxxx).
  • heif-enc can now accept input from WebP, HEIF, pure raw files (including floating point pixel data), and CMYK JPEG (converted to RGB).
  • TIFF input can now read many TIFF formats used in geospatial imaging, like: 16-bit, signed integers, float samples, tiled TIFFs,…
Record
SUSE-SU-2026:22153-1
Updated
2026-11-02
OSVSUSE-SU-2026:2622-1 No score

Security update for libheif

This update for libheif fixes the following issues

Update to 1.23.0:

  • CVE-2025-68431: heap buffer over-read in HeifPixelImage: overlay() via crafted HEIF that exercises the overlay image item (bsc#1255735).
  • CVE-2026-3950: manipulation of the component stsz/stts can lead to out-of-bounds read (bsc#1259544).
  • CVE-2026-32738: Heap OOB Read / SEGV Crash via Zero samples_per_chunk in stsc (bsc#1265874).
  • CVE-2026-32739: Infinite Loop DoS in stts Sample Duration Lookup (bsc#1265875).
  • CVE-2026-32740: Heap-Buffer-Overflow Write in Grid Tile Chroma Compositing (bsc#1265876).
  • CVE-2026-32741: heap buffer overflow in decode_mask_image() (bsc#1265877).
  • CVE-2026-32814: Uninitialized Heap Memory Information Leak via Failed Grid Tiles (bsc#1265878).
  • CVE-2026-32882: Heap Buffer OOB Read in overlay compositing due to wrong alpha stride (bsc#1265879).
  • CVE-2026-41069: Out-of-bounds vector access leading to invalid dereference (bsc#1265979).
  • CVE-2026-41071: Heap buffer over-read in SampleAuxInfoReader via crafted HEIF sequence file with mismatched saiz sample count (bsc#1265980).
  • CVE-2026-47178: Heap Out Of Bounds Write in unci subsystem (bsc#1265981).
  • CVE-2026-47247: Heap Information Disclosure via Grid Image Gap + Uninitialized Pixel Plane Allocation (bsc#1265982).
  • CVE-2026-47251: integer overflow bypass in vvdec_push_data2 (bsc#1265983).
  • CVE-2026-47254: Heap Buffer Overflow in Track: get_next_sample_raw_data() -- OOB Chunk Vector Access (bsc#1265987).
  • CVE-2026-47709: NULL pointer dereference in heif_image_handle_get_image_tiling for malformed unci image missing ispe (bsc#1265988).
  • CVE-2026-47714: Integer overflow in inline mask size calculation causes undersized buffer allocation (bsc#1265989).
  • CVE-2026-48029: heap OOB read in ImageItem_Grid: decode_grid_tile via irot-induced tile-coordinate underflow (bsc#1265990).
  • CVE-2026-49271: Wrapped icef compressed-unit range check causes out-of-bounds read in uncompressed HEIF decoder (bsc#1266282).
  • CVE-2026-50142: unbounded heap allocation in HEIF sequence parser (bsc#1267455).
  • Heap buffer overflow via uint32_t stride overflow in image plane allocation (+ 2 additional instances) (bsc#1265997).
  • Incorrect byte-count initialization in BitstreamRange constructor allows container-boundary check bypass (bsc#1265995).
  • Integer Overflow in SampleAuxInfoReader Offset Calculation (bsc#1265992).
  • Out-of-bounds read and assertion-based DoS in EXIF parsing (find_exif_tag / read32) with short EXIF TIFF payload (bsc#1265996).
  • Out-of-bounds write in inline mask region API when source mask exceeds declared region (bsc#1266281).

Changes for libheif:

  • version update to 1.23.0:
  • add API functions to read and write metadata: ambient viewing environment nominal diffuse white luminance
  • adds a output_image_nclx_profile_passthrough option to heif_decoding_options
  • CVE-2026-50142 (GHSA-jvmp-j3cw-84mh) - unbounded heap allocation in HEIF sequence parser (stsz fixed-size mode missing bound check)
  • version update to 1.22.2:
  • build issues with OpenJPEG plugin (#1813)
  • non-plain C in header (#1812)
  • CVE-2026-49271 (GHSA-r7qj-cg5r-r6vf) - Wrapped icef compressed-unit range check causes out-of-bounds read in uncompressed HEIF decoder
  • CVE TBD (GHSA-5hqq-636x-r3cr) - Out-of-bounds write in inline mask region API when source mask exceeds declared region
  • update to 1.22.0:
  • This is a large release with substantial new functionality, mainly focusing on generalized image formats (e.g., multi- spectral images) and a reworked implementation of ISO/IEC 23001-17 (lossless image codec).
  • HDR up to 64 bpp
  • Multi-component images with arbitrary component layouts (multi-spectral images, arbitrary non-visual data)
  • Filter-array (Bayer / mosaic) images, with debayering in color transformation pipeline
  • Metadata: chroma-sample location (cloc), sample non- uniformity (snuc), sensor bad-pixel map (sbpm), polarization pattern (splz)
  • heif-dec can…
Record
SUSE-SU-2026:2622-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
libheif
Alpaquita:stream
 1.20.2-r2 up to 1.22.2-r0
1.22.2-r0
libheif
Debian:12
 All versions, plus listed versions
1.15.1-11.15.1-1+deb12u11.16.2-11.16.2-21.16.2-3
Show 32 moreShow less
1.17.0-11.17.1-11.17.4-11.17.6-11.17.6-21.17.6-31.17.6-41.18.1-11.18.1-21.18.2-11.18.2-21.19.1-11.19.1-1~bpo12+11.19.1-1~bpo12+21.19.3-11.19.3-1~bpo12+11.19.5-11.19.7-11.19.7-1~bpo12+11.19.8-11.20.1-11.20.2-11.20.2-21.21.2-11.21.2-21.21.2-31.21.2-41.23.1-11.23.2-11.23.3-11.23.4-11.23.4-1~deb13u1
 None known
libheif
Debian:14
 before 1.23.1-1, plus listed versions
1.19.8-11.20.1-11.20.2-11.20.2-21.21.2-11.21.2-21.21.2-31.21.2-4
1.23.1-1
libheif
Mageia:10
From an advisory covering 11 CVEs
 before 1.20.2-3.1.mga10
1.20.2-3.1.mga10
libheif
Mageia:10
From an advisory covering 11 CVEs
 before 1.20.2-3.1.mga10.tainted
1.20.2-3.1.mga10.tainted
libheif
Root:Debian:11
 before 1.11.0-1+deb11u2.aikido.5
1.11.0-1+deb11u2.aikido.51.11.0-1+deb11u2.aikido.61.11.0-1+deb11u2.root.io.4
rootio-libheif
Root:Debian:11
 before 1.11.0-1+deb11u2.aikido.5
1.11.0-1+deb11u2.aikido.51.11.0-1+deb11u2.aikido.61.11.0-1+deb11u2.root.io.4
libheif
Root:Debian:12
 before 1.15.1-1+deb12u1.root.io.10
1.15.1-1+deb12u1.root.io.101.15.1-1+deb12u1.root.io.111.15.1-1+deb12u1.aikido.121.15.1-1+deb12u1.aikido.131.15.1-1+deb12u1.aikido.141.15.1-1+deb12u1.aikido.151.15.1-1+deb12u1.aikido.161.15.1-1+deb12u1.aikido.17
rootio-libheif
Root:Debian:12
 before 1.15.1-1+deb12u1.root.io.10
1.15.1-1+deb12u1.root.io.101.15.1-1+deb12u1.root.io.111.15.1-1+deb12u1.aikido.121.15.1-1+deb12u1.aikido.131.15.1-1+deb12u1.aikido.141.15.1-1+deb12u1.aikido.151.15.1-1+deb12u1.aikido.161.15.1-1+deb12u1.aikido.17
libheif
SUSE:Linux Enterprise Server 16.0
From an advisory covering 20 CVEs
 before 1.23.0-160000.1.1
1.23.0-160000.1.1
Show 10 moreShow less
Affected packages
PackageAffectedFixed
libheif
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 20 CVEs
 before 1.23.0-160000.1.1
1.23.0-160000.1.1
libheif
SUSE:Linux Enterprise Module for Desktop Applications 15 SP7
From an advisory covering 20 CVEs
 before 1.23.0-150700.3.15.1
1.23.0-150700.3.15.1
libheif
SUSE:Linux Enterprise Module for Package Hub 15 SP7
From an advisory covering 20 CVEs
 before 1.23.0-150700.3.15.1
1.23.0-150700.3.15.1
libheif
Ubuntu:Pro:20.04:LTS
 before 1.6.1-1ubuntu0.1~esm3, plus listed versions
1.5.0-1build11.5.1-11.5.1-1build11.6.0-11.6.1-11.6.1-1build11.6.1-1ubuntu0.1~esm11.6.1-1ubuntu0.1~esm2
1.6.1-1ubuntu0.1~esm3
libheif
Ubuntu:Pro:22.04:LTS
 before 1.12.0-2ubuntu0.1~esm3, plus listed versions
1.11.0-11.12.0-2build11.12.0-2ubuntu0.1~esm11.12.0-2ubuntu0.1~esm2
1.12.0-2ubuntu0.1~esm3
libheif
Ubuntu:24.04:LTS
 before 1.17.6-1ubuntu4.4, plus listed versions
1.16.2-2ubuntu11.17.1-1ubuntu21.17.1-1ubuntu31.17.4-1ubuntu11.17.6-1ubuntu1
Show 6 moreShow less
1.17.6-1ubuntu21.17.6-1ubuntu31.17.6-1ubuntu41.17.6-1ubuntu4.11.17.6-1ubuntu4.21.17.6-1ubuntu4.3
1.17.6-1ubuntu4.4
libheif
Ubuntu:25.10
 before 1.20.2-1ubuntu0.4, plus listed versions
1.19.7-11.19.8-11.20.2-11.20.2-1ubuntu0.11.20.2-1ubuntu0.3
1.20.2-1ubuntu0.4
libheif
Ubuntu:26.04:LTS
 before 1.21.2-3ubuntu0.1, plus listed versions
1.20.2-11.20.2-21.20.2-2build11.20.2-2build21.20.2-2ubuntu11.21.2-11.21.2-3
1.21.2-3ubuntu0.1
libheif
openSUSE:Tumbleweed
From an advisory covering 16 CVEs
 before 1.22.2-1.1
1.22.2-1.1
libheif
openSUSE:Leap 16.0
From an advisory covering 20 CVEs
 before 1.23.0-160000.1.1
1.23.0-160000.1.1

History

History
RecordedChangedSources
affected, facts
affectedOSV
affected
first indexedCVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-32814 is a medium vulnerability (CVSS 6.5) in Strukturag Libheif, published May 19, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.31%, the 24th percentile. Fixed in libheif 1.22.2-r0.

References

Show 54 moreShow less
This page doesn't list everything

Left out here: the rest of 3 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open