libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and below, a crafted 800-byte HEIF sequence file causes an infinite loop in Box_stts::get_sample_duration(), consuming 100% CPU indefinitely with zero progress, leading to DoS. The loop has no iteration limit or timeout and is triggered during file open (parsing) - before any user interaction or image decoding. The process stays alive (no crash, no error logged), making it invisible to crash-based monitoring. This issue has been fixed in version 1.22.0.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8454-1 advisory.

    Elhanan Haenel discovered that libheif incorrectly handled certain malformed HEIF sequence files. An     attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 25.10     and Ubuntu 26.04 LTS. (CVE-2026-32738)

    Elhanan Haenel discovered that libheif incorrectly handled certain malformed HEIF sequence files, leading     to an infinite loop. An attacker could possibly use this issue to cause libheif to use excessive     resources, resulting in a denial of service. This issue only affected Ubuntu 25.10 and Ubuntu 26.04 LTS.
    (CVE-2026-32739)

    Elhanan Haenel discovered that libheif incorrectly handled certain crafted HEIF/AVIF image files. An     attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue     only affected Ubuntu 25.10 and Ubuntu 26.04 LTS. (CVE-2026-32740)

    It was discovered that libheif incorrectly handled certain crafted HEIF files containing mask images. An     attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue     only affected Ubuntu 24.04 LTS, Ubuntu 25.10, and Ubuntu 26.04 LTS. (CVE-2026-32741)

    It was discovered that libheif incorrectly handled certain crafted grid-based HEIF/AVIF files. An attacker     could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 20.04 LTS,     Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 25.10, and Ubuntu 26.04 LTS. (CVE-2026-32814)

    It was discovered that libheif incorrectly handled certain crafted HEIF files when compositing overlay     images. An attacker could possibly use this issue to cause a denial of service or obtain sensitive     information. (CVE-2026-32882)

    It was discovered that libheif incorrectly handled certain crafted files. An attacker could possibly use     this issue to cause a denial of service. This issue only affected Ubuntu 25.10 and Ubuntu 26.04 LTS.
    (CVE-2026-3950)

    It was discovered that libheif incorrectly handled certain malformed HEIF sequence files. An attacker     could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 25.10 and     Ubuntu 26.04 LTS. (CVE-2026-41069)

    It was discovered that libheif incorrectly handled certain crafted HEIF sequence files. An attacker could     possibly use this issue to cause a denial of service. This issue only affected Ubuntu 25.10 and Ubuntu     26.04 LTS. (CVE-2026-41071)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and below, a crafted     800-byte HEIF sequence file causes an infinite loop in Box_stts::get_sample_duration(), consuming 100% CPU     indefinitely with zero progress, leading to DoS. The loop has no iteration limit or timeout and is     triggered during file open (parsing) - before any user interaction or image decoding. The process stays     alive (no crash, no error logged), making it invisible to crash-based monitoring. This issue has been     fixed in version 1.22.0. (CVE-2026-32739)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
321763	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : libheif vulnerabilities (USN-8454-1)	Nessus	Ubuntu Local Security Checks	medium
316386	Linux Distros Unpatched Vulnerability : CVE-2026-32739	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-32739

medium

Tenable Plugins

medium

medium