libheif 1.22.0 patches HEIC heap overflow CVE-2026-32740
On 19 May 2026, strukturag released libheif 1.22.0 with a large security batch. The headline fix is CVE-2026-32740 (CVSS 8.8): a crafted HEIC or AVIF grid image can write 64 bytes past a chroma-plane heap buffer during normal decode. If you open untrusted phone photos or social downloads in a desktop viewer that embeds an older libheif, update the app - or convert first with a browser tool such as HEIC to JPG when you only need a JPEG.
Last reviewed: 2026-07-19
What happened
libheif is the common open-source HEIF/AVIF library behind many Linux viewers, thumbnailers, and CLI converters. GitHub advisory GHSA-frfr-f3vg-2g6j and NVD describe CVE-2026-32740 as a heap-buffer-overflow write in grid tile chroma compositing for versions through 1.21.2. The trigger is a specially built HEIF/AVIF with a 1x4 grid of odd-height tiles under YCbCr 4:2:0. The release notes for v1.22.0 list that CVE plus a long set of related integer-overflow, OOB, and uninitialized-memory fixes (about eighteen advisories in the Security section). Opening the file with a default build is enough to hit the path - no special plugin required.
| Detail | Value |
|---|---|
| Library | libheif (strukturag) |
| Fixed release | 1.22.0 (2026-05-19) |
| Key CVE | CVE-2026-32740 (CVSS 8.8) |
| Affected | libheif <= 1.21.2 |
| Trigger | Crafted HEIC/AVIF grid decode |
| Advisory | GHSA-frfr-f3vg-2g6j |
Why it matters for everyday files
iPhone and many Android cameras still land photos as HEIC. Friends send them over chat; archives hold years of .heic side by side with JPEG. Desktop apps that decode those files often pull in libheif rather than Apple's stack. A heap write on open means a hostile image is not just "won't preview" - it can corrupt memory in the same process that holds your other files. That is the same class of risk as a hostile PDF in a desktop reader. Browser conversion paths that never install a local libheif build are a practical way to handle one-off untrusted HEIC drops. For background on why HEIC showed up on phones in the first place, see HEIC arrived with iOS 11.
What to do with your files right now
If you decode HEIC or AVIF on a desktop or server:
- Update libheif to 1.22.0 or newer in package managers, app stores, or any self-built converter (heif-dec / heif-convert).
- Rebuild or upgrade viewers that statically link libheif - a distro package bump may not cover a bundled app binary.
- Treat unexpected .heic/.avif attachments as untrusted until the decoder is patched; prefer a browser convert such as HEIC to JPG when you only need a shareable JPEG.
- Keep a JPEG or PNG copy of important photos if you still share across PCs that lag on HEIC decode (see the HEIC history note above).