CVE-2026-32738

Name of the Vulnerable Software and Affected Versions libheif versions prior to 1.22.0

Description An unsigned integer underflow occurs in the Chunk constructor when processing a crafted HEIF sequence file containing samples per chunk=0 in the stsc box. This causes all samples to map to an empty chunk, leading to a denial of service. A segmentation fault (SEGV), which is a null-page read, is triggered when the library attempts to access the first frame by reading from index 0 of an empty std::vector.

Recommendations Update to version 1.22.0.