## Ticket: CVE-2026-32740 — libheif grid-tile heap-buffer-overflow write

**Advisory**: GHSA-frfr-f3vg-2g6j — https://github.com/strukturag/libheif/security/advisories/GHSA-frfr-f3vg-2g6j
**CVE**: CVE-2026-32740 | **CWE-787** (Out-of-bounds Write)
**Severity**: High — CVSS 3.1 base 8.8
**Package**: `libheif` (C++ HEIF/AVIF library) | **Repository**: https://github.com/strukturag/libheif

### Impact

A crafted HEIF/AVIF image with a 1×4 grid of odd-height tiles causes the
chroma-plane decoder to write **64 bytes** of attacker-controlled chroma data
past the end of the chroma-plane allocation during a normal decode with the
default build options.

The out-of-bounds write is reachable via the standard decode path on a
malicious input file — any application that decodes untrusted HEIF/AVIF with
libheif's default build is exposed to a heap-buffer-overflow write.

### Affected / fixed versions

Affected: `libheif` `<= 1.21.2`.
Fixed: **`1.22.0`**.

Reproduce on a vulnerable build (**`1.21.2`**) and verify the fix on
**`1.22.0`**.

### Where to look

The fix commit is not pre-pinned in the advisory metadata. Locate the patch
in the `1.21.2` → `1.22.0` history:

```bash
git clone https://github.com/strukturag/libheif.git
cd libheif && git log v1.21.2..v1.22.0 --oneline
# narrow to chroma / grid / tile changes in the decoder
```

### Reproduction approach

The bug is observable from a single decode invocation under AddressSanitizer
— no network service, database, or browser is needed.

1. Build the **vulnerable** binary with ASan:
   `git checkout v1.21.2 && cmake -DCMAKE_C_FLAGS='-fsanitize=address -g' -DCMAKE_CXX_FLAGS='-fsanitize=address -g' . && make`
2. Craft a HEIF/AVIF PoC file containing a 1×4 grid of odd-height tiles
   whose chroma planes trigger the 64-byte OOB write.
3. Decode it: `./bin/heif-convert poc.heif out.png` (or call the libheif C
   API from a tiny C harness).
4. Repeat with the **fixed** build (`git checkout v1.22.0`).

### Expected result

| Build | `heif-convert poc.heif out.png` (ASan) |
|-------|-----------------------------------------|
| `libheif v1.21.2` (vulnerable) | aborts with `==ERROR: AddressSanitizer: heap-buffer-overflow WRITE of size 64` during chroma-plane decode |
| `libheif v1.22.0` (fixed) | completes the conversion (or returns a clean error) with **no ASan diagnostic** |

- **Vulnerable indicator**: ASan report `heap-buffer-overflow WRITE of size 64`
  on the chroma-plane allocation during decode.
- **Fixed indicator**: no ASan diagnostic; decode completes (or fails
  gracefully via libheif's error path) without memory corruption.

### Expected artifacts

- `reproduction_steps.sh` — builds both libheif versions with
  `-fsanitize=address`, decodes the crafted PoC, and captures the ASan
  output (or its absence) for each.
- `validation_verdict.json` — `verdict: confirmed`, with the vulnerable and
  fixed indicators captured.
- Logs containing the ASan report from `v1.21.2` and the clean run from
  `v1.22.0`.
- The crafted PoC HEIF/AVIF file used to trigger the overflow.