CVE-2026-32740 is a heap-buffer-overflow (CWE-787) vulnerability in the strukturag libheif library, affecting versions prior to 1.22.0. The flaw occurs during the decoding of HEIF/AVIF files that contain a 1×4 grid of odd-height tiles, where the grid tile compositing logic writes 64 bytes beyond the allocated chroma plane buffer. The overflowed data consists of chroma pixel values controlled by the attacker, enabling full control over the overflow content. This vulnerability is triggered during normal image decoding with the default build configuration. The issue has been addressed and fixed in libheif version 1.22.0. The CVSS v3.1 base score is 8.8, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker to write 64 bytes of attacker-controlled data beyond the allocated heap buffer for chroma pixels during image decoding. This can lead to memory corruption, potentially resulting in arbitrary code execution, denial of service, or other impacts depending on the context in which libheif is used.

A fix is available in libheif version 1.22.0. Users and vendors should upgrade to version 1.22.0 or later to remediate this vulnerability. No additional mitigations are indicated by the vendor advisory.