Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and below, a crafted 792-byte HEIF sequence file with samples_per_chunk=0 in the stsc box causes an unsigned integer underflow in the Chunk constructor (m_last_sample = 0 + 0 - 1 = UINT32_MAX), mapping all samples to an empty chunk and resulting in a denial of service. When any sample is accessed, the library reads from index 0 of an empty std::vector, causing a guaranteed SEGV (null-page read). The file parses successfully without producing an error; the crash occurs on the first frame access. This issue has been fixed in version 1.22.0.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-32738 Integer Underflow Denial of Service in libheif Versions 1.21.2 and Below https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-32738
Post summary
The post announces CVE‑2026‑32738, an integer underflow denial‑of‑service flaw in libheif (1.21.2 and earlier), but offers no PoC, exploit, active‑exploitation evidence, or patch information.
CVE-2026-32738 libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and below, a crafted 792-byte HEIF sequence file with samples_per_chunk=0 in the stsc b… https://www.cve.org/CVERecord?id=CVE-2026-32738
Post summary
The post discloses CVE-2026-32738 related to libheif, describing a crafted HEIF file that triggers a failure, but provides no PoC, exploit, or patch information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | struktur | libheif | - | - | - |