CVE-2026-32882

What it actually does

CVE-2026-32882 is a heap buffer over-read in libheif versions 1.21.2 and earlier, specifically in HeifPixelImage::overlay() in libheif/pixelimage.cc. When decoding or compositing a crafted HEIF image that uses an overlay image item and mismatched alpha-channel and color-channel bit depths, libheif indexes the alpha plane using the color-channel stride instead of the alpha-plane stride. This can cause reads beyond the end of the alpha buffer. The most likely technical outcome is process crash and denial of service; limited heap memory disclosure may also be possible if adjacent bytes are incorporated into decoded output pixels.

Why it matters to the business

Applications, services, image-processing pipelines, content moderation systems, thumbnail generators, document converters, and desktop software that parse untrusted HEIF or AVIF files through vulnerable libheif versions can be crashed by a malicious image. In some cases, decoded output may contain small amounts of unintended process memory, creating a potential confidentiality concern. The issue requires a victim system or service to process a crafted file, but no authentication is required once the file reaches a vulnerable parser. EPSS is currently low and there is no known KEV listing or ransomware association, but the vulnerability is still operationally relevant because libheif is commonly embedded in downstream software and image-processing workflows.

How an attack unfolds

An attacker creates a malformed HEIF file containing an overlay image item where the child image uses different bit depths for alpha and color channels. The file is then delivered to a target through a route that causes automated or user-triggered decoding, such as upload to an image service, attachment preview, content ingestion pipeline, media library scan, or opening the file in an affected application. When vulnerable libheif code composites the overlay, HeifPixelImage::overlay() uses the wrong stride while reading the alpha plane, causing an out-of-bounds heap read. Depending on allocator layout, compiler protections, and application behavior, the result may be a crash, service restart, failed image processing job, or leaked heap bytes embedded into generated pixels. No public exploit maturity is currently reported, and exploitation is not known to be used by named threat actors, but the bug is reachable through crafted media content wherever vulnerable libheif decoding is exposed.

How to fix it

Upgrade libheif to version 1.22.0 or later. Because libheif is frequently bundled or statically linked into larger applications, update both operating-system packages and any vendor-supplied or embedded copies used by image libraries, media applications, web services, converters, and container images. If immediate upgrade is not possible, reduce exposure by disabling HEIF/AVIF uploads or previews from untrusted sources, sandboxing image decoding workers, enforcing memory and CPU limits on media-processing jobs, isolating thumbnail generation from sensitive processes, and rejecting HEIF files that contain overlay image items until patched. Rebuild dependent software against the fixed library where static linking is used.

How to confirm the fix worked

Confirm that all deployed libheif instances report version 1.22.0 or later, including package-managed libraries, container images, application bundles, and statically linked builds. On Linux systems, check package versions with the relevant package manager and inspect linked libraries with tools such as ldd, readelf, objdump, or container SBOM scanners. For source builds, verify that the patch correcting alpha_stride usage in HeifPixelImage::overlay() is present. Validate runtime behavior by processing known-good HEIF/AVIF samples and, in a controlled test environment only, regression-test malformed overlay images to confirm they are safely rejected or decoded without crashing. Review crash telemetry and image-processing error rates after remediation to ensure vulnerable workers are no longer faulting in libheif overlay handling.

Typical attack path

1. Identify an application, service, or workflow that accepts or processes HEIF/AVIF images using libheif 1.21.2 or earlier.
2. Craft a HEIF file containing an overlay image item with mismatched alpha-channel and color-channel bit depths.
3. Deliver the crafted image through an upload form, attachment, shared file, media library, email preview, conversion workflow, or other ingestion path.
4. Trigger image decoding or thumbnail generation by the vulnerable application or background worker.
5. Cause HeifPixelImage::overlay() to read beyond the alpha buffer due to incorrect stride usage.
6. Achieve denial of service through a crash, or potentially recover limited adjacent heap bytes if the decoded output is returned or stored.

How to detect it

Look for evidence that applications or workers processing HEIF/AVIF files crashed or produced abnormal decoded output. Useful sources include application logs from upload and thumbnail services, image-conversion job logs, web access logs for HEIF/AVIF uploads shortly before crashes, system logs, core dump metadata, EDR crash telemetry, container restart events, and sanitizer reports from testing or hardened builds. Focus on crashes where stack traces reference libheif, HeifPixelImage::overlay(), pixelimage.cc, or overlay image item processing. Correlate these events with inbound files whose MIME type or filename indicates HEIF/HEIC/AVIF content, especially repeated failures from the same user agent, IP address, or upload workflow. For potential memory disclosure, review generated images from suspicious processing jobs for unexpected pixel artifacts, though reliable confirmation generally requires controlled reproduction and forensic analysis of the submitted file. There are no known public threat actors, KEV activity, or ransomware campaigns associated with this issue at this time.

• HeifPixelImage::overlay
• libheif/pixelimage.cc
• heap-buffer-over-read
• heap-buffer-overflow
• AddressSanitizer: heap-buffer-over-read
• ERROR: AddressSanitizer
• SIGSEGV
• segmentation fault
• libheif.so
• heif_context_read_from_file
• heif_decode_image
• iovl
• ftypheic
• ftypheix
• ftyphevc
• ftypavif
• .heic
• .heif
• .avif

What your security team should do

• Inventory all systems, applications, containers, serverless functions, desktop packages, and third-party products that include or link against libheif.
• Prioritize patching internet-facing upload, preview, conversion, and thumbnail-generation services that process untrusted images.
• Upgrade libheif to 1.22.0 or later and rebuild any statically linked downstream applications.
• Apply temporary controls for unpatched systems: restrict HEIF/AVIF uploads, sandbox decoders, isolate media workers, and limit access to generated decoded output.
• Search crash logs, application logs, and EDR telemetry for recent faults involving libheif, HeifPixelImage::overlay(), or heap-buffer-over-read errors during HEIF processing.
• Add monitoring for repeated malformed HEIF processing failures from the same source, as this may indicate fuzzing or exploitation attempts.
• Request confirmation from software vendors that bundle libheif that their products include the 1.22.0 fix or equivalent backport.