{
  "ticket_id": "CVE-2026-32738",
  "code_root": "external/libheif",
  "source": {
    "type": "cve",
    "cve_id": "CVE-2026-32738",
    "advisory_id": "GHSA-7f2h-cmpf-v9ww",
    "advisory_url": "https://github.com/strukturag/libheif/security/advisories/GHSA-7f2h-cmpf-v9ww",
    "vendor": "strukturag",
    "product": "libheif",
    "repo": "https://github.com/strukturag/libheif"
  },
  "facts": {
    "cve_id": "CVE-2026-32738",
    "advisory_id": "GHSA-7f2h-cmpf-v9ww",
    "issue_summary": "Integer underflow leading to an out-of-bounds read (DoS) in libheif. A crafted HEIF sequence file with samples_per_chunk = 0 in the 'stsc' box makes the Chunk constructor compute m_last_sample = first_sample + samples_per_chunk - 1 = 0 + 0 - 1, which underflows to UINT32_MAX. A later access of any sample then indexes into an empty std::vector at index 0, producing a null-page out-of-bounds read and a SIGSEGV crash.",
    "vulnerability_type": "Integer Underflow leading to Out-of-bounds Read (Denial of Service)",
    "suspected_cwe": ["CWE-191"],
    "affected_versions": "<= 1.21.2",
    "fixed_versions": ["1.22.0"],
    "reproduce_version": "1.21.2",
    "verify_fixed_version": "1.22.0",
    "repo_url": "https://github.com/strukturag/libheif.git",
    "code_root": "external/libheif",
    "language": "C++",
    "attacker_access": "Any actor who can supply a HEIF/HEIC sequence file to a program that uses libheif (e.g. an image upload, a file passed to a CLI tool).",
    "exploit_outline": "Craft a small HEIF sequence file whose 'stsc' (sample-to-chunk) box specifies samples_per_chunk = 0. When libheif parses it, the Chunk constructor computes m_last_sample = 0 + 0 - 1, underflowing to UINT32_MAX. Reading any sample then accesses index 0 of an empty std::vector, dereferencing the null page.",
    "vulnerable_indicator": "On libheif 1.21.2, running a tool such as heif-info or heif-convert on the crafted file crashes with SIGSEGV (signal 11) and a non-zero exit code.",
    "fixed_indicator": "On libheif 1.22.0, the crafted file is handled cleanly: the tool either reports a controlled decode error or exits 0, with no SIGSEGV.",
    "reproduction_requirements": "A C++ toolchain to build libheif 1.21.2 and 1.22.0 (CMake), libheif's build dependencies, and a crafted HEIF sequence file with stsc samples_per_chunk = 0. A libheif CLI tool (heif-info / heif-convert) is sufficient to trigger the parse. No network service or database required.",
    "notes": "The fix commit is not pinned; the repro agent should locate it in the 1.21.2 -> 1.22.0 history. Building with AddressSanitizer makes the out-of-bounds read explicit, but a plain build already crashes with SIGSEGV on the vulnerable version."
  }
}