Skip to content
Critical Vulnerabilities in libheif Affect Ubuntu Users

Critical Vulnerabilities in libheif Affect Ubuntu Users

First seen 18 Jun 2026, 22:24 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •June 19, 2026 at 22:24 UTC
  • •libheif vulnerabilities could lead to denial of service or arbitrary code execution.
  • •Affected systems include Ubuntu 25.10 and 26.04 LTS with specific CVEs published on 2026-05-19.
  • •Users are urged to update their systems to the latest package versions to mitigate risks.

Multiple vulnerabilities in the libheif library were discovered by Elhanan Haenel, affecting Ubuntu 25.10 and Ubuntu 26.04 LTS. These vulnerabilities could lead to denial of service or arbitrary code execution through malformed HEIF/AVIF files. Specific CVEs include CVE-2026-32738, CVE-2026-32739, CVE-2026-32740, and CVE-2026-32741, all published on 2026-05-19. Users are advised to update their systems to mitigate these risks. The vulnerabilities exploit improper handling of image files, potentially allowing attackers to consume excessive resources or execute malicious code. The issues have been confirmed and patches are available for affected versions.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 93d ago How this analysis works

Timeline

2026-03-11
CVE-2026-3950 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-05-19
Multiple CVEs published for libheif vulnerabilities
CVE-2026-32738, CVE-2026-32739, CVE-2026-32740, and CVE-2026-32741 were published, detailing critical issues in libheif.
Ubuntu
2026-05-19
CVE-2026-32738 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-05-19
CVE-2026-32740 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-05-19
CVE-2026-32882 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-05-19
CVE-2026-32739 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-05-19
CVE-2026-32741 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-05-19
CVE-2026-32814 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-05-22
CVE-2026-41071 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-05-22
CVE-2026-41069 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE

More articles in this cluster (11)

Following this threat?

Track Ubuntu and CVE-2026-32738 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (15)

1 / 3