Denial of Service Vulnerability in libheif HEIF and AVIF File Format Decoder by strukturag
CVE-2026-32738

6.5MEDIUM

Key Information:

Vendor

Strukturag

Status
Libheif
Vendor
CVE Published:
19 May 2026

What is CVE-2026-32738?

A specific flaw in the libheif library, which handles HEIF and AVIF file formats, can lead to a denial of service. When processing a specially crafted 792-byte HEIF sequence file with a samples_per_chunk value of zero in the stsc box, an unsigned integer underflow occurs in the Chunk constructor. This issue maps all samples to an empty chunk, resulting in a crash upon accessing any frame, as the library attempts to read from index 0 of an empty std::vector. The issue is resolved in version 1.22.0, emphasizing the importance of updating to ensure protection against this vulnerability.

Affected Version(s)

libheif < 1.22.0

References

https://github.com/strukturag/libheif/security/advisories...
x_refsource_CONFIRM

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.