Heap Buffer Over-read in Libheif File Format Decoder from Struktur AG
CVE-2026-32882

7.1HIGH

Key Information:

Vendor: Strukturag
Status: Libheif
Vendor: CVE Published:; 19 May 2026

Badges

👾 Exploit Exists📰 News Worthy

What is CVE-2026-32882?

CVE-2026-32882 is a vulnerability found in the libheif library, which is designed for decoding and encoding HEIF (High Efficiency Image File Format) and AVIF (AV1 Image File Format) files. The specific flaw occurs in the function HeifPixelImage::overlay(), where a heap buffer over-read can occur when processing overlay images with inconsistencies in bit depth for alpha channels compared to color channels. This mismanagement in handling the alpha plane can lead to unauthorized memory access, resulting in a denial of service by causing the application to crash or exposing adjacent heap memory. Organizations relying on libheif for image processing could face significant operational disruptions, potential data leaks, and a tarnished reputation due to security risks.

Potential impact of CVE-2026-32882

Denial of Service (DoS): Exploitations of this vulnerability can crash applications using the libheif library, leading to service interruptions and downtime, which can hinder business operations.
Data Leakage: The flaw can allow attackers to read sensitive information from adjacent memory locations, potentially disclosing confidential data that the application should not expose.
Integration Risks: Since libheif is often integrated into larger software ecosystems, the vulnerability poses risks not only to the direct users of the library but also to any application or service consuming these images, increasing the attack surface for potential exploitation.