CVE-2026-32882

libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.21.2 and prior contain a heap buffer over-read in HeifPixelImage::overlay() in libheif/pixelimage.cc. When compositing an overlay image (iovl) whose child image has a different bit depth for the alpha channel than for the color channels, the function indexes into the alpha plane using the color channel stride (in_stride) instead of the previously retrieved alpha_stride, causing reads past the end of the alpha buffer (up to 3,123 bytes for a 100×50 image with 10-bit color and 8-bit alpha). A crafted HEIF file can exploit this to cause a denial of service (crash) or potentially disclose adjacent heap memory through leaked bytes embedded in the decoded output pixels. This issue has been fixed in versionThis issue has been fixed in version 1.22.0.

• CWE-125
• CWE-125

• https://github.com/strukturag/libheif/releases/tag/v1.22.0
• https://github.com/strukturag/libheif/security/advisories/GHSA-hg7q-rjr2-8x46
• https://access.redhat.com/security/cve/CVE-2026-32882
• https://bugzilla.redhat.com/show_bug.cgi?id=2480000
• https://github.com/strukturag/libheif/security/advisories/GHSA-hg7q-rjr2-8x46
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32882.json

Published

May 19, 2026

Last Modified

Jul 24, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-32877Botan is a C++ cryptography library. From version 2.3.0 to b…8.2
• CVE-2026-32878Parse Server is an open source backend that can be deployed …7.5
• CVE-2026-32879New API is a large language mode (LLM) gateway and artificia…4.9
• CVE-2026-3288A security issue was discovered in ingress-nginx where the `…8.8
• CVE-2026-32880ChurchCRM is an open-source church management system. Versio…6.4
• CVE-2026-32881ewe is a Gleam web server. ewe is a Gleam web server. Versio…5.3
• CVE-2026-32883Botan is a C++ cryptography library. From version 3.0.0 to b…5.9
• CVE-2026-32884Botan is a C++ cryptography library. Prior to version 3.11.0…5.9
• CVE-2026-32885DDEV is an open-source tool for running local web developmen…9.1
• CVE-2026-32886Parse Server is an open source backend that can be deployed …7.5
• CVE-2026-32887Effect is a TypeScript framework that consists of several pa…7.4
• CVE-2026-32888Open Source Point of Sale is a web based point-of-sale appli…8.8