CVE-2026-32741

A flaw was found in libheif, a library for decoding and encoding HEIF (High Efficiency Image File Format) and AVIF files. A remote attacker could exploit a heap buffer overflow vulnerability in the MaskImageCodec::decode_mask_image() function by providing a specially crafted HEIF file containing a mask image. This vulnerability occurs because the function copies image data into a buffer without proper size validation, allowing the attacker-controlled input to exceed the allocated memory. Successful exploitation can lead to a denial of service (DoS) and potentially other impacts due to memory corruption.