Is CVE-2026-32814 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-32814 being exploited in the wild.

How severe is CVE-2026-32814?

Medium severity, with a CVSS score of 6.5, published 19 May 2026.

Is there a fix for CVE-2026-32814?

A patch was published on 2026-05-19: Fixed in version 1.22.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-32814 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-32814?

Check whether you run struktur AG Libheif at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-32814: Strukturag libheif uninitialized heap memory leak in grid image decoding

CVE-2026-32814 · Severity: medium · CVSS 6.5 · Published 2026-05-19

libheif is a software library used to process HEIF and AVIF images, commonly used by websites and applications to handle user-uploaded photos. A vulnerability exists where a specially crafted image can cause the library to fail silently during processing and instead return raw, uninitialized memory from the server's heap as if it were part of the image. If an application re-processes this image (for example, creating a thumbnail), it may inadvertently leak sensitive internal data—such as authentication tokens, database results, or other users' information—back to the attacker.

Technologies: struktur AG Libheif. Vendors: struktur AG.

Quick answers

Is CVE-2026-32814 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-32814 being exploited in the wild.
How severe is CVE-2026-32814?: Medium severity, with a CVSS score of 6.5, published 19 May 2026.
Which products and versions are affected?: struktur AG Libheif <= 1.21.2.
Is there a fix for CVE-2026-32814?: A patch was published on 2026-05-19: Fixed in version 1.22.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-32814 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-32814?: Check whether you run struktur AG Libheif at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability in libheif versions 1.21.2 and prior allows for an uninitialized heap memory information leak when decoding HEIF grid images. The issue stems from two combined flaws: first, the library's canvas allocation for Y, Cb, and Cr planes does not zero-initialize memory; second, when 'strict_decoding' is set to false (the default), the library silently ignores tile decoding failures and returns 'heif_error_Ok'. An attacker can provide a crafted .heic or .avif file with a corrupted tile, causing the library to return uninitialized heap data (approximately 12KB per failed tile) as decoded pixel values. If the calling application subsequently encodes or displays this image, the leaked heap contents—potentially containing sensitive data from other processes—are exposed. This has been patched in version 1.22.0.

Affected products

strukturag libheif <= 1.21.2

Timeline

2026-05-19: advisory: GitHub Security Advisory published
2026-05-19: patched: Fixed in version 1.22.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.