{
  "ticket_id": "CVE-2026-32740",
  "code_root": "external/libheif",
  "source": {
    "type": "cve",
    "cve_id": "CVE-2026-32740",
    "advisory_id": "GHSA-frfr-f3vg-2g6j",
    "advisory_url": "https://github.com/strukturag/libheif/security/advisories/GHSA-frfr-f3vg-2g6j",
    "vendor": "strukturag",
    "product": "libheif",
    "repo": "https://github.com/strukturag/libheif"
  },
  "facts": {
    "cve_id": "CVE-2026-32740",
    "advisory_id": "GHSA-frfr-f3vg-2g6j",
    "issue_summary": "A crafted HEIF/AVIF image with a 1x4 grid of odd-height tiles causes the chroma-plane decoder to write 64 bytes of attacker-controlled chroma data past the end of the chroma-plane allocation during a normal decode with the default build options. The OOB write is reachable via the standard decode path on a malicious input file.",
    "vulnerability_type": "Heap-buffer-overflow write (memory corruption)",
    "suspected_cwe": ["CWE-787"],
    "affected_versions": "<= 1.21.2",
    "fixed_versions": ["1.22.0"],
    "reproduce_version": "1.21.2",
    "verify_fixed_version": "1.22.0",
    "repo_url": "https://github.com/strukturag/libheif.git",
    "fix_commit": null,
    "code_root": "external/libheif",
    "ecosystem": "source (C++)",
    "package": "libheif",
    "affected_components": ["grid-tile chroma-plane decoder"],
    "install_recipe": "Build libheif from source at the specified git tag: `git clone https://github.com/strukturag/libheif && cd libheif && git checkout v1.21.2` (vulnerable) or `git checkout v1.22.0` (fixed), then a CMake build with `-DCMAKE_C_FLAGS='-fsanitize=address -g' -DCMAKE_CXX_FLAGS='-fsanitize=address -g'`. Default build options are sufficient to reach the bug.",
    "attacker_access": "Any code path that decodes an attacker-supplied HEIF/AVIF image with libheif's default build options (e.g. `heif-convert input.heif out.png`).",
    "primary_entry_point": "heif-convert (or the libheif C API) on a crafted HEIF/AVIF file with a 1x4 grid of odd-height tiles",
    "exploit_outline": "Build libheif 1.21.2 with `-fsanitize=address`, craft a HEIF/AVIF file containing a 1x4 grid of odd-height tiles whose chroma planes cause a 64-byte write past the end of the chroma-plane allocation, and decode it with `heif-convert` (or a small C harness calling the C API).",
    "vulnerable_indicator": "AddressSanitizer aborts the process with `heap-buffer-overflow WRITE of size 64` during decode.",
    "fixed_indicator": "libheif 1.22.0 completes the conversion (or returns a clean error) with no ASan diagnostic.",
    "reproduction_requirements": "C/C++ toolchain with AddressSanitizer support (clang or recent gcc), CMake, and libheif's standard build dependencies. No network service or database. A crafted HEIF/AVIF PoC file is needed; the agent should construct one consistent with the advisory's 1x4-grid-of-odd-height-tiles description.",
    "notes": "The fix commit is not pre-pinned; the Pruva repro agent should locate the relevant patch(es) in the 1.21.2 -> 1.22.0 history (e.g. `git log v1.21.2..v1.22.0` filtered to chroma / grid / tile changes)."
  }
}