CVE-2026-32738

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-32738", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-13T15:02:00.628Z", "datePublished": "2026-05-19T19:03:48.553Z", "dateUpdated": "2026-05-19T19:38:59.260Z"}, "containers": {"cna": {"title": "libheif has a Heap OOB Read/SEGV Crash via Zero samples_per_chunk", "problemTypes": [{"descriptions": [{"cweId": "CWE-125", "lang": "en", "description": "CWE-125: Out-of-bounds Read", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-476", "lang": "en", "description": "CWE-476: NULL Pointer Dereference", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/strukturag/libheif/security/advisories/GHSA-7f2h-cmpf-v9ww", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/strukturag/libheif/security/advisories/GHSA-7f2h-cmpf-v9ww"}], "affected": [{"vendor": "strukturag", "product": "libheif", "versions": [{"version": "< 1.22.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-19T19:03:48.553Z"}, "descriptions": [{"lang": "en", "value": "libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and below, a crafted 792-byte HEIF sequence file with samples_per_chunk=0 in the stsc box causes an unsigned integer underflow in the Chunk constructor (m_last_sample = 0 + 0 - 1 = UINT32_MAX), mapping all samples to an empty chunk and resulting in a denial of service. When any sample is accessed, the library reads from index 0 of an empty std::vector, causing a guaranteed SEGV (null-page read). The file parses successfully without producing an error; the crash occurs on the first frame access. This issue has been fixed in version 1.22.0."}], "source": {"advisory": "GHSA-7f2h-cmpf-v9ww", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/strukturag/libheif/security/advisories/GHSA-7f2h-cmpf-v9ww", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-19T19:35:48.534273Z", "id": "CVE-2026-32738", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-19T19:38:59.260Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-32738", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-19T19:35:48.534273Z"}}}], "references": [{"url": "https://github.com/strukturag/libheif/security/advisories/GHSA-7f2h-cmpf-v9ww", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-19T19:33:35.814Z"}}], "cna": {"title": "libheif has a Heap OOB Read/SEGV Crash via Zero samples_per_chunk", "source": {"advisory": "GHSA-7f2h-cmpf-v9ww", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "strukturag", "product": "libheif", "versions": [{"status": "affected", "version": "< 1.22.0"}]}], "references": [{"url": "https://github.com/strukturag/libheif/security/advisories/GHSA-7f2h-cmpf-v9ww", "name": "https://github.com/strukturag/libheif/security/advisories/GHSA-7f2h-cmpf-v9ww", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and below, a crafted 792-byte HEIF sequence file with samples_per_chunk=0 in the stsc box causes an unsigned integer underflow in the Chunk constructor (m_last_sample = 0 + 0 - 1 = UINT32_MAX), mapping all samples to an empty chunk and resulting in a denial of service. When any sample is accessed, the library reads from index 0 of an empty std::vector, causing a guaranteed SEGV (null-page read). The file parses successfully without producing an error; the crash occurs on the first frame access. This issue has been fixed in version 1.22.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125: Out-of-bounds Read"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-476", "description": "CWE-476: NULL Pointer Dereference"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-19T19:03:48.553Z"}}}, "cveMetadata": {"cveId": "CVE-2026-32738", "state": "PUBLISHED", "dateUpdated": "2026-05-19T19:38:59.260Z", "dateReserved": "2026-03-13T15:02:00.628Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-19T19:03:48.553Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "libheif", "vendor": "strukturag", "versions": [{"status": "affected", "version": "< 1.22.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:struktur:libheif:*:*:*:*:*:*:*:*", "matchCriteriaId": "CB01CAAF-1D64-461B-8CC0-3CF2FBAC60A5", "versionEndExcluding": "1.22.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and below, a crafted 792-byte HEIF sequence file with samples_per_chunk=0 in the stsc box causes an unsigned integer underflow in the Chunk constructor (m_last_sample = 0 + 0 - 1 = UINT32_MAX), mapping all samples to an empty chunk and resulting in a denial of service. When any sample is accessed, the library reads from index 0 of an empty std::vector, causing a guaranteed SEGV (null-page read). The file parses successfully without producing an error; the crash occurs on the first frame access. This issue has been fixed in version 1.22.0."}, {"lang": "es", "value": "libheif es un decodificador y codificador de formato de archivo HEIF y AVIF. En las versiones 1.21.2 e inferiores, un archivo de secuencia HEIF de 792 bytes manipulado con samples_per_chunk=0 en la caja stsc causa un desbordamiento negativo de entero sin signo en el constructor de Chunk (m_last_sample = 0 + 0 - 1 = UINT32_MAX), mapeando todas las muestras a un fragmento vac\u00edo y resultando en una denegaci\u00f3n de servicio. Cuando se accede a cualquier muestra, la biblioteca lee desde el \u00edndice 0 de un std::vector vac\u00edo, causando un SEGV garantizado (lectura de p\u00e1gina nula). El archivo se analiza correctamente sin producir un error; el fallo ocurre en el primer acceso al fotograma. Este problema ha sido corregido en la versi\u00f3n 1.22.0."}], "id": "CVE-2026-32738", "lastModified": "2026-07-24T09:10:00.153", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-32738", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-19T19:35:48.534273Z", "version": "2.0.3"}}]}, "published": "2026-05-19T19:16:48.823", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/strukturag/libheif/security/advisories/GHSA-7f2h-cmpf-v9ww"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/strukturag/libheif/security/advisories/GHSA-7f2h-cmpf-v9ww"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}, {"lang": "en", "value": "CWE-476"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "libheif: libheif: Unsigned integer underflow leads to Denial of Service", "id": "2479968", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2479968"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-191", "details": ["A flaw was found in libheif, a HEIF and AVIF file format decoder and encoder. A remote attacker could exploit this vulnerability by providing a specially crafted HEIF sequence file. This file, with `samples_per_chunk=0`, triggers an unsigned integer underflow, causing the library to map all samples to an empty chunk. When any sample is accessed, the library attempts to read from an invalid memory location, leading to a denial of service due to a guaranteed crash."], "name": "CVE-2026-32738", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "glycin-loaders", "product_name": "Red Hat Enterprise Linux 10"}], "public_date": "2026-05-19T19:03:48Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-32738\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-32738\nhttps://github.com/strukturag/libheif/security/advisories/GHSA-7f2h-cmpf-v9ww"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.22.0)"}}], "enrichment": {"confidence": 94.0, "confidence_source": "matching", "scores": [{"score": 94.0, "source": "matching"}]}, "original": {"product": "libheif", "source": "cna", "vendor": "strukturag"}, "product": "libheif", "vendor": "struktur"}], "created": "2026-05-19T20:30:13.400890+00:00", "updated": "2026-05-20T10:15:15.977138+00:00", "vendors": ["struktur", "struktur$PRODUCT$libheif"]}