{
  "ticket_id": "CVE-2026-32740",
  "cve_id": "CVE-2026-32740",
  "advisory_id": "GHSA-frfr-f3vg-2g6j",
  "verdict": "validated",
  "confidence": "high",
  "validated_at": "2026-05-23T06:14:27Z",
  "validation_method": "runtime_reproduction",
  "affected_component": "libheif",
  "affected_versions": "<= 1.21.2",
  "fixed_version": "1.22.0",
  "vulnerability_type": "heap-buffer-overflow-write",
  "cwe": ["CWE-787"],
  "severity": "high",
  "cvss_base_score": 8.8,
  "reproducibility": "deterministic",
  "reproduction_summary": {
    "vulnerable_run": {
      "version": "1.21.2",
      "tool": "AddressSanitizer",
      "result": "crash",
      "signal": "heap-buffer-overflow",
      "details": "WRITE of size 32 in HeifPixelImage::copy_image_to during chroma plane compositing for a 1x4 grid of odd-height tiles"
    },
    "fixed_run": {
      "version": "1.22.0",
      "tool": "AddressSanitizer",
      "result": "no_crash",
      "details": "Decodes successfully without AddressSanitizer errors"
    }
  },
  "root_cause_summary": "In HeifPixelImage::copy_image_to(), independent ceiling-divisions for the destination chroma offset (ys) and copy height (copy_height) can sum to exceed the allocated chroma plane height by one row when decoding YCbCr 4:2:0 grid tiles with odd heights.",
  "exploitability": {
    "prerequisites": ["attacker can supply a crafted HEIF/AVIF image"],
    "user_interaction": "none",
    "privileges_required": "none",
    "attack_vector": "local",
    "impact": "heap corruption, potential code execution, denial of service"
  },
  "files": {
    "reproduction_script": "repro/reproduction_steps.sh",
    "poc_source": "repro/poc.c",
    "poc_binary": "repro/poc",
    "poc_input": "repro/poc.heif",
    "rca_report": "repro/rca_report.md",
    "runtime_manifest": "repro/runtime_manifest.json",
    "vuln_stderr": "logs/vuln_stderr.txt",
    "fix_stdout": "logs/fix_stdout.txt",
    "fix_stderr": "logs/fix_stderr.txt"
  },
  "notes": "Both vulnerable and fixed builds were compiled with AddressSanitizer. The PoC harness was compiled and linked against each build in turn. The same poc.heif triggers the heap-buffer-overflow reliably on the vulnerable build and completes cleanly on the fixed build."
}