CVE-2026-32741

Name of the Vulnerable Software and Affected Versions libheif versions prior to 1.22.0

Description A heap buffer overflow exists in the MaskImageCodec::decode mask image() function when decoding a HEIF file containing a mask image (mski). The issue occurs because the function copies the full iloc extent data into a pixel buffer using memcpy() without performing an upper-bound check on the data length. Since the copy length data.size() is attacker-controlled via the iloc extent while the destination buffer is sized based on declared image dimensions, a crafted file can cause a heap overflow. This specific path is triggered when the mskC property specifies bits per pixel = 8 and the ispe property declares an even width greater than or equal to 64. Successful exploitation may lead to a denial of service (DoS) or memory corruption.

Recommendations Update libheif to version 1.22.0.