Heap Buffer Overflow in libheif HEIF and AVIF File Format Decoder by Struktur AG

CVE-2026-32741

What is CVE-2026-32741?

CVE-2026-32741 is a critical vulnerability discovered in libheif, an open-source encoder and decoder for the HEIF and AVIF file formats, developed by Struktur AG. The vulnerability arises from a heap buffer overflow that occurs during the processing of mask images within HEIF files. Specifically, the flaw resides in the MaskImageCodec::decode_mask_image() function, where the system uses the memcpy() function to copy data from an attacker-controlled input into a statically allocated pixel buffer. Due to the absence of proper upper-bound checks on the size of data being copied, a maliciously crafted HEIF file can cause the data to exceed the allocated memory, resulting in a potential overflow that may lead to arbitrary code execution or system crashes. This vulnerability poses serious risks for organizations utilizing libheif, particularly those that rely on the software for media applications or platforms accessing user-uploaded HEIF files, as attackers could exploit it to compromise system integrity or execute unauthorized code.

Potential impact of CVE-2026-32741

1. Arbitrary Code Execution: The most significant risk associated with CVE-2026-32741 is the potential for arbitrary code execution on affected systems. An attacker could craft a malicious HEIF file that, when processed, could execute arbitrary commands in the context of the vulnerable application, leading to full system compromise.

2. Denial of Service (DoS): The exploitation of the heap buffer overflow could also lead to a denial of service condition, where affected applications crash or become unresponsive. This can disrupt critical services, particularly in environments that handle large volumes of media processing, affecting overall business operations.

3. Data Integrity and Confidentiality Risks: Exploiting this vulnerability could allow attackers to manipulate or access sensitive data processed by the libheif library. This poses a risk to data integrity and confidentiality, especially if the application handles user-generated content or confidential information, leading to potential data breaches or loss of sensitive information.

References