Heap Memory Information Leak in libheif HEIF/AVIF File Decoder by strukturAG

CVE-2026-32814

What is CVE-2026-32814?

The libheif library, a decoder and encoder for HEIF and AVIF file formats, exposes applications using it to a vulnerability where a corrupted grid image tile can lead to an uninitialized heap memory information leak. Default settings in version 1.21.2 allow for this exploitation, as the library erroneously returns a success status even when decoding fails, resulting in sensitive data from previous heap allocations being passed as decoded pixel values. This issue poses significant risks during server-side image processing, where crafted images can lead to the unintended exposure of cross-user data, including authentication tokens and other sensitive information. The vulnerability has been addressed in version 1.22.0.

References