libheif 1.22.0 va loi tran HEIC CVE-2026-32740
Ngay 19 thang 5 nam 2026, strukturag phat hanh libheif 1.22.0 voi goi sua loi bao mat lon. Diem chinh la CVE-2026-32740 (CVSS 8.8): mot anh HEIC hoac AVIF luoi duoc tao dac biet co the ghi 64 byte vuot buffer heap cua mat phang chroma khi giai ma binh thuong. Neu ban mo anh dien thoai hoac file tai ve khong tin cay bang trinh xem desktop nhung libheif cu, hay cap nhat ung dung - hoac chuyen doi truoc bang cong cu trinh duyet nhu HEIC to JPG khi chi can JPEG.
Last reviewed: 2026-07-19
What happened
libheif la thu vien HEIF/AVIF ma nguon pho bien dung sau nhieu trinh xem Linux, bo tao thumbnail va bo chuyen doi CLI. Advisory GHSA-frfr-f3vg-2g6j va NVD mo ta CVE-2026-32740 la heap-buffer-overflow write trong ghep tile luoi o ban den 1.21.2. Kich hoat la HEIF/AVIF luoi 1x4 tile chieu cao le voi YCbCr 4:2:0. Ghi chu phat hanh v1.22.0 liet ke CVE do va hang loat loi overflow, OOB va bo nho chua khoi tao (khoang muoi tam advisory trong muc Security). Chi can mo file voi ban build mac dinh - khong can plugin dac biet.
| Detail | Value |
|---|---|
| Library | libheif (strukturag) |
| Fixed release | 1.22.0 (2026-05-19) |
| Key CVE | CVE-2026-32740 (CVSS 8.8) |
| Affected | libheif <= 1.21.2 |
| Trigger | Crafted HEIC/AVIF grid decode |
| Advisory | GHSA-frfr-f3vg-2g6j |
Why it matters for everyday files
iPhone va nhieu Android van luu anh HEIC. Ban be gui qua chat; kho luu nam .heic can JPEG. Ung dung desktop giai ma thuong dung libheif, khong phai stack cua Apple. Ghi heap khi mo nghia la anh doc hai khong chi "khong xem truoc duoc" - co the pha hong bo nho cung tien trinh voi file khac. Do la cung lop rui ro voi PDF doc hai tren Reader desktop. Duong chuyen doi tren trinh duyet khong cai libheif cuc bo huu ich cho HEIC khong tin cay. De hieu vi sao HEIC xuat hien tren dien thoai, xem HEIC arrived with iOS 11.
What to do with your files right now
Neu ban giai ma HEIC hoac AVIF tren desktop hay may chu:
- Cap nhat libheif len 1.22.0 tro len qua trinh quan ly goi, cua hang ung dung, hoac bo chuyen doi tu bien dich (heif-dec / heif-convert).
- Build lai hoac cap nhat trinh xem link tinh libheif - bump goi distro co the khong dut binary dong goi.
- Coi tep .heic/.avif bat ngo la khong tin cay cho den khi decoder duoc va; uu tien chuyen tren trinh duyet bang HEIC to JPG khi chi can JPEG de chia se.
- Giu ban sao JPEG hoac PNG cho anh quan trong neu van chia se voi PC cham HEIC (xem ghi chu lich su o tren).