CVE-2026-32741 is a heap-based buffer overflow vulnerability in the libheif library, specifically in the MaskImageCodec::decode_mask_image() function. When decoding a HEIF file with a mask image (mski), the function copies data using memcpy without an upper-bound check on the data length. The length is derived from the iloc extent in the file, which is attacker-controlled, while the destination buffer size is based on declared image dimensions. This mismatch can cause a heap overflow if the iloc extent exceeds the pixel buffer allocation. The vulnerable code path is triggered when the mskC property specifies bits_per_pixel = 8 and the ispe property declares an even width of at least 64. This vulnerability affects libheif versions prior to 1.22.0 and has been fixed in version 1.22.0.

An attacker can craft a malicious HEIF file that triggers a heap-based buffer overflow during decoding, potentially leading to denial of service or other impacts related to memory corruption. The CVSS v3.1 score is 7.1 (high), indicating a network attack vector with low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, limited integrity impact, and high availability impact.

This vulnerability is fixed in libheif version 1.22.0. Users should upgrade to version 1.22.0 or later to remediate this issue. Patch status is not explicitly stated in the vendor advisory excerpt, but the description confirms the fix in 1.22.0. No additional mitigations are indicated by the vendor advisory.