CVE-2026-32882: libheif: Heap Buffer OOB Read in overlay compositing due to wrong alpha stride
Last updated 19 June 2026
Other sources
libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.21.2 and prior contain a heap buffer over-read in HeifPixelImage::overlay() in libheif/pixelimage.cc. When compositing an overlay image (iovl) whose child image has a different bit depth for the alpha channel than for the color channels, the function indexes into the alpha plane using the color channel stride (instride) instead of the previously retrieved alphastride, causing reads past the end of the alpha buffer (up to 3,123 bytes for a 100×50 image with 10-bit color and 8-bit alpha). A crafted HEIF file can exploit this to cause a denial of service (crash) or potentially disclose adjacent heap memory through leaked bytes embedded in the decoded output pixels. This issue has been fixed in versionThis issue has been fixed in version 1.22.0.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
libheifto a version that resolves this vulnerability.Fixed in 1.22.0
Event History
Frequently Asked Questions
What is the risk level of CVE-2026-32882?
CVE-2026-32882 has a risk level of 47, indicating a significant potential impact.
What is the severity rating of CVE-2026-32882?
CVE-2026-32882 has a high severity rating of 7.1 on the CVSS scale.
How do I fix CVE-2026-32882?
To mitigate CVE-2026-32882, upgrade to libheif version 1.22.0 or later.
What type of vulnerability is CVE-2026-32882?
CVE-2026-32882 is classified as a heap buffer out-of-bounds read vulnerability.
What can be affected by CVE-2026-32882?
CVE-2026-32882 affects versions of libheif prior to 1.22.0, specifically during overlay compositing functions.