libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.21.2 and prior contain a heap-buffer-overflow (write) vulnerability in the grid tile compositing, allowing an attacker to write 64 bytes of fully attacker-controlled data past the end of a chroma plane heap allocation by crafting a HEIF/AVIF file with a 1×4 grid of odd-height tiles. The overflow is triggered during normal image decoding with default build configuration. The written bytes are chroma (Cb/Cr) pixel values from the attacking tile, giving the attacker full control over the overflow content. This issue has been fixed in version 1.22.0.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8454-1 advisory.

    Elhanan Haenel discovered that libheif incorrectly handled certain malformed HEIF sequence files. An     attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 25.10     and Ubuntu 26.04 LTS. (CVE-2026-32738)

    Elhanan Haenel discovered that libheif incorrectly handled certain malformed HEIF sequence files, leading     to an infinite loop. An attacker could possibly use this issue to cause libheif to use excessive     resources, resulting in a denial of service. This issue only affected Ubuntu 25.10 and Ubuntu 26.04 LTS.
    (CVE-2026-32739)

    Elhanan Haenel discovered that libheif incorrectly handled certain crafted HEIF/AVIF image files. An     attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue     only affected Ubuntu 25.10 and Ubuntu 26.04 LTS. (CVE-2026-32740)

    It was discovered that libheif incorrectly handled certain crafted HEIF files containing mask images. An     attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue     only affected Ubuntu 24.04 LTS, Ubuntu 25.10, and Ubuntu 26.04 LTS. (CVE-2026-32741)

    It was discovered that libheif incorrectly handled certain crafted grid-based HEIF/AVIF files. An attacker     could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 20.04 LTS,     Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 25.10, and Ubuntu 26.04 LTS. (CVE-2026-32814)

    It was discovered that libheif incorrectly handled certain crafted HEIF files when compositing overlay     images. An attacker could possibly use this issue to cause a denial of service or obtain sensitive     information. (CVE-2026-32882)

    It was discovered that libheif incorrectly handled certain crafted files. An attacker could possibly use     this issue to cause a denial of service. This issue only affected Ubuntu 25.10 and Ubuntu 26.04 LTS.
    (CVE-2026-3950)

    It was discovered that libheif incorrectly handled certain malformed HEIF sequence files. An attacker     could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 25.10 and     Ubuntu 26.04 LTS. (CVE-2026-41069)

    It was discovered that libheif incorrectly handled certain crafted HEIF sequence files. An attacker could     possibly use this issue to cause a denial of service. This issue only affected Ubuntu 25.10 and Ubuntu     26.04 LTS. (CVE-2026-41071)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1814 advisory.

    libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.21.2 and prior contain a heap-     buffer-overflow (write) vulnerability in the grid tile compositing, allowing an attacker to write 64 bytes     of fully attacker-controlled data past the end of a chroma plane heap allocation by crafting a HEIF/AVIF     file with a 1x4 grid of odd-height tiles. The overflow is triggered during normal image decoding with     default build configuration. The written bytes are chroma (Cb/Cr) pixel values from the attacking tile,     giving the attacker full control over the overflow content. This issue has been fixed in version 1.22.0.
    (CVE-2026-32740)

    libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.21.2 and below contain a heap     buffer overflow in MaskImageCodec::decode_mask_image(). When decoding a HEIF file containing a mask image     (mski), the function copies the full iloc extent data into a pixel buffer using memcpy(dst, data.data(),     data.size()). The copy length data.size() is determined by the iloc extent in the file (attacker-     controlled), while the destination buffer is sized based on the declared image dimensions. Because no     upper-bound check exists on the data length, a crafted file whose iloc extent exceeds the pixel buffer     allocation overflows the heap. The vulnerable single-memcpy branch is reached when the mskC property     specifies bits_per_pixel = 8 and the ispe property declares an even width >= 64 (so that stride == width),     with no changes to default security limits or external codec plugins required. This issue has been fixed     in version 1.22.0. (CVE-2026-32741)

    libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.21.2 and prior contain a heap     buffer over-read in HeifPixelImage::overlay() in libheif/pixelimage.cc. When compositing an overlay image     (iovl) whose child image has a different bit depth for the alpha channel than for the color channels, the     function indexes into the alpha plane using the color channel stride (in_stride) instead of the previously     retrieved alpha_stride, causing reads past the end of the alpha buffer (up to 3,123 bytes for a 100x50     image with 10-bit color and 8-bit alpha). A crafted HEIF file can exploit this to cause a denial of     service (crash) or potentially disclose adjacent heap memory through leaked bytes embedded in the decoded     output pixels. This issue has been fixed in versionThis issue has been fixed in version 1.22.0.
    (CVE-2026-32882)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.21.2 and prior contain a heap-     buffer-overflow (write) vulnerability in the grid tile compositing, allowing an attacker to write 64 bytes     of fully attacker-controlled data past the end of a chroma plane heap allocation by crafting a HEIF/AVIF     file with a 14 grid of odd-height tiles. The overflow is triggered during normal image decoding with     default build configuration. The written bytes are chroma (Cb/Cr) pixel values from the attacking tile,     giving the attacker full control over the overflow content. This issue has been fixed in version 1.22.0.
    (CVE-2026-32740)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
321763	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : libheif vulnerabilities (USN-8454-1)	Nessus	Ubuntu Local Security Checks	medium
319823	Amazon Linux 2023 : heif-pixbuf-loader, libheif, libheif-devel (ALAS2023-2026-1814)	Nessus	Amazon Linux Local Security Checks	high
316385	Linux Distros Unpatched Vulnerability : CVE-2026-32740	Nessus	Misc.	high

Detections

Analytics

CVE-2026-32740

high

Tenable Plugins

medium

high

high