libheif, a HEIF and AVIF file format decoder and encoder, contains a heap buffer over-read vulnerability in versions prior to 1.22.0. The flaw is in the HeifPixelImage::overlay() function where, during compositing of an overlay image with mismatched alpha and color channel bit depths, the alpha plane is incorrectly indexed using the color channel stride instead of the alpha stride. This results in reading beyond the allocated alpha buffer by up to 3,123 bytes for certain image dimensions and bit depths. A crafted HEIF file can exploit this to cause a crash or leak adjacent heap memory through the decoded pixel output. The vulnerability is tracked as CVE-2026-32882 and classified under CWE-125 (Out-of-bounds Read).

Successful exploitation can cause a denial of service due to application crash or potentially disclose adjacent heap memory contents, leading to information leakage. The CVSS v3.1 base score is 7.1 (High), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, low confidentiality impact, no integrity impact, and high availability impact.

Upgrade libheif to version 1.22.0 or later, where this vulnerability has been fixed. No other official remediation or temporary fixes are indicated. Patch status is confirmed fixed in 1.22.0.