CVE-2026-32741 libheif has a heap buffer overflow in decode_mask_image()
A heap buffer overflow in libheif allows attackers to execute arbitrary code or cause denial of service via a crafted HEIF file.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-32741?
CVE-2026-32741 is a high-severity memory corruption vulnerability in strukturag libheif, published on 19 May 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.21.2 and below contain a heap buffer overflow in MaskImageCodec::decode_mask_image(). When decoding a HEIF file containing a mask image (mski), the function copies the full iloc extent data into a pixel buffer using memcpy(dst, data.data(), data.size()). The copy length data.size() is determined by the iloc extent in the file (attacker-controlled), while the destination buffer is sized based on the declared image dimensions. Because no upper-bound check exists on the data length, a crafted file whose iloc extent exceeds the pixel buffer allocation overflows the heap. The vulnerable single-memcpy branch is reached when the mskC property specifies bits_per_pixel = 8 and the ispe property declares an even width ≥ 64 (so that stride == width), with no changes to default security limits or external codec plugins required. This issue has been fixed in version 1.22.0.
Which versions are affected by CVE-2026-32741?
How do I fix CVE-2026-32741?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-32741 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-32741 exists.
Sources
Also known as BELL-CVE-2026-32741, DEBIAN-CVE-2026-32741, ECHO-0dff-8373-3408, GHSA-j3w5-7whq-p37q, ROOT-OS-DEBIAN-11-CVE-2026-32741, ROOT-OS-DEBIAN-12-CVE-2026-32741 and 1 more.