CVE-2026-32740

Description

libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.21.2 and prior contain a heap-buffer-overflow (write) vulnerability in the grid tile compositing, allowing an attacker to write 64 bytes of fully attacker-controlled data past the end of a chroma plane heap allocation by crafting a HEIF/AVIF file with a 1×4 grid of odd-height tiles. The overflow is triggered during normal image decoding with default build configuration. The written bytes are chroma (Cb/Cr) pixel values from the attacking tile, giving the attacker full control over the overflow content. This issue has been fixed in version 1.22.0.

How to fix CVE-2026-32740

To remediate CVE-2026-32740, upgrade the affected package to a fixed version below.

• —upgrade to 1.23.0-r0 or later
• —no fix listed

Is CVE-2026-32740 being exploited?

Low — EPSS is 0.0%, meaning exploitation activity has not been observed at scale.

Affected packages (2)

• from 0, < 1.23.0-r0
• from 0

CVSS scores

References (2)

• ADVISORYsecurity.alpinelinux.org/vuln/CVE-2026-32740
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2026-32740