Quick answers
- Is CVE-2026-32741 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-32741 being exploited in the wild.
- How severe is CVE-2026-32741?
- High severity, with a CVSS score of 7.1, published 19 May 2026.
- Which products and versions are affected?
- struktur AG Libheif <= 1.21.2.
- Is there a fix for CVE-2026-32741?
- A patch was published on 2026-05-19: Fixed in version 1.22.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-32741 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-32741?
- Check whether you run struktur AG Libheif at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A heap buffer overflow exists in libheif's MaskImageCodec::decode_mask_image() function within mask_image.cc. The vulnerability occurs when the library processes a HEIF file containing a mask image (mski) item. The function uses memcpy() to copy data from the file's iloc extent into a destination pixel buffer. While the destination buffer is sized based on declared image dimensions (ispe property), the copy length is taken directly from the attacker-controlled iloc extent length without an upper-bound check. An attacker can trigger this by providing a file where the iloc extent exceeds the allocated pixel buffer size, specifically when bits_per_pixel is 8 and the image width is an even value ≥ 64. This results in heap corruption, leading to a denial of service or potential arbitrary code execution. The issue is fixed in version 1.22.0.
Affected products
- strukturag libheif <= 1.21.2
Timeline
- 2026-05-19: disclosed
- 2026-05-19: patched: Fixed in version 1.22.0
- 2026-05-19: advisory