CVE-2026-32882

CVE-2026-32882 identifies a heap buffer over-read vulnerability within `libheif`, a library responsible for decoding and encoding HEIF and AVIF image formats. This flaw affects `libheif` versions 1.21.2 and earlier. The vulnerability specifically arises in the `HeifPixelImage::overlay()` function when processing an overlay image where the alpha channel has a different bit depth than the color channels. In this scenario, the function incorrectly uses the color channel stride instead of the alpha stride, leading to reads beyond the allocated alpha buffer. Exploitation of CVE-2026-32882 can result in a denial of service due to application crashes or the potential disclosure of adjacent heap memory, with leaked bytes embedded in the decoded output pixels. While the vulnerability itself is an out-of-bounds read, it has been demonstrated in conjunction with other issues to achieve remote code execution (RCE) in various platforms that process HEIF/AVIF images, including OpenAI, Slack, Meta, Discourse, Next.js, and GitHub Enterprise. The issue was addressed in `libheif` version 1.22.0.