CVE-2026-32814: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor in strukturag libheif
libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, when decoding a HEIF grid image with strict_decoding=false (the default), a corrupted tile silently fails to decode and the library returns heif_error_Ok with no indication of failure, leading to an uninitialized heap memory information leak. The canvas is allocated via create_clone_image_at_new_size() → plane.alloc() → new (std::nothrow) uint8_t[allocation_size] which does not zero the memory; only the alpha plane is explicitly initialized via fill_plane(), so the Y, Cb, and Cr planes contain whatever was previously at that heap address. The failed tile's region of the canvas is never written. It retains uninitialized heap data that is delivered to the caller as decoded pixel values (4,096 bytes per Y/Cb/Cr plane = 12,288+ bytes total). Any application using libheif to decode grid-based HEIF/AVIF files with default settings is vulnerable: a crafted .heic or .avif file causes 4,096+ bytes of heap memory to appear as pixel values in the decoded image, and the calling application receives heif_error_Ok, so it has no indication the output contains heap garbage. In server-side image processing, an uploaded crafted HEIF decoded and re-encoded (e.g., as PNG/JPEG for thumbnails, CDN, social media) can leak cross-user data such as auth tokens, database results, and other users' image data. This issue has been fixed in version 1.22.0.
AI Analysis
Technical Summary
libheif, a HEIF and AVIF image decoder/encoder, in versions prior to 1.22.0, has a vulnerability where decoding a HEIF grid image with strict_decoding=false (default) and a corrupted tile results in silent failure to decode that tile. The library returns heif_error_Ok without signaling the failure, leading to uninitialized heap memory being included in the decoded pixel data for the Y, Cb, and Cr planes. This memory leak can expose sensitive data such as authentication tokens or other users' image data when the decoded image is further processed or re-encoded. The vulnerability is addressed in version 1.22.0.
Potential Impact
Applications using libheif to decode grid-based HEIF or AVIF images with default settings may unintentionally expose uninitialized heap memory as pixel data. This can result in leakage of sensitive information including authentication tokens, database results, or other users' image data, especially in server-side image processing scenarios where images are uploaded, decoded, and re-encoded for thumbnails or content delivery. The vulnerability does not affect integrity or availability but poses a confidentiality risk.
Mitigation Recommendations
This vulnerability has been fixed in libheif version 1.22.0. Users and developers should upgrade to version 1.22.0 or later to remediate this issue. Until upgraded, avoid processing untrusted HEIF/AVIF grid images with libheif using default decoding settings. Patch status is not explicitly stated beyond the fix in 1.22.0; check the vendor's official advisory for the latest remediation guidance.
CVE-2026-32814: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor in strukturag libheif
Description
libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, when decoding a HEIF grid image with strict_decoding=false (the default), a corrupted tile silently fails to decode and the library returns heif_error_Ok with no indication of failure, leading to an uninitialized heap memory information leak. The canvas is allocated via create_clone_image_at_new_size() → plane.alloc() → new (std::nothrow) uint8_t[allocation_size] which does not zero the memory; only the alpha plane is explicitly initialized via fill_plane(), so the Y, Cb, and Cr planes contain whatever was previously at that heap address. The failed tile's region of the canvas is never written. It retains uninitialized heap data that is delivered to the caller as decoded pixel values (4,096 bytes per Y/Cb/Cr plane = 12,288+ bytes total). Any application using libheif to decode grid-based HEIF/AVIF files with default settings is vulnerable: a crafted .heic or .avif file causes 4,096+ bytes of heap memory to appear as pixel values in the decoded image, and the calling application receives heif_error_Ok, so it has no indication the output contains heap garbage. In server-side image processing, an uploaded crafted HEIF decoded and re-encoded (e.g., as PNG/JPEG for thumbnails, CDN, social media) can leak cross-user data such as auth tokens, database results, and other users' image data. This issue has been fixed in version 1.22.0.
CVSS v3.1
Score 6.5medium
Affected software
pkg:github/strukturag/libheifRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
libheif, a HEIF and AVIF image decoder/encoder, in versions prior to 1.22.0, has a vulnerability where decoding a HEIF grid image with strict_decoding=false (default) and a corrupted tile results in silent failure to decode that tile. The library returns heif_error_Ok without signaling the failure, leading to uninitialized heap memory being included in the decoded pixel data for the Y, Cb, and Cr planes. This memory leak can expose sensitive data such as authentication tokens or other users' image data when the decoded image is further processed or re-encoded. The vulnerability is addressed in version 1.22.0.
Potential Impact
Applications using libheif to decode grid-based HEIF or AVIF images with default settings may unintentionally expose uninitialized heap memory as pixel data. This can result in leakage of sensitive information including authentication tokens, database results, or other users' image data, especially in server-side image processing scenarios where images are uploaded, decoded, and re-encoded for thumbnails or content delivery. The vulnerability does not affect integrity or availability but poses a confidentiality risk.
Mitigation Recommendations
This vulnerability has been fixed in libheif version 1.22.0. Users and developers should upgrade to version 1.22.0 or later to remediate this issue. Until upgraded, avoid processing untrusted HEIF/AVIF grid images with libheif using default decoding settings. Patch status is not explicitly stated beyond the fix in 1.22.0; check the vendor's official advisory for the latest remediation guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-03-16T17:35:36.696Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a0cc91dba1db47362ec07cb
Added to database: 05/19/2026, 20:33:33 UTC
Last enriched: 05/19/2026, 20:48:54 UTC
Last updated: 07/31/2026, 19:22:58 UTC
Views: 141
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.