CVE-2026-32738
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
In libheif (versions 1.21.2 and below), a crafted HEIF file with samples_per_chunk=0 in the stsc box causes an unsigned integer underflow in the Chunk constructor, leading to an out-of-bounds read and crash (SEGV) on the first frame access. The file parses without error, but crashes when attempting to display.
Risk Assessment
An attacker can crash applications using libheif, leading to denial of service.
Recommendation
Update libheif to version 1.22.0 or later, which contains a fix.
Original NVD description (English source)
libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and below, a crafted 792-byte HEIF sequence file with samples_per_chunk=0 in the stsc box causes an unsigned integer underflow in the Chunk constructor (m_last_sample = 0 + 0 - 1 = UINT32_MAX), mapping all samples to an empty chunk and resulting in a denial of service. When any sample is accessed, the library reads from index 0 of an empty std::vector, causing a guaranteed SEGV (null-page read). The file parses successfully without producing an error; the crash occurs on the first frame access. This issue has been fixed in version 1.22.0.