SB20260731145 - SUSE update for libheif
Published: July 31, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 2 vulnerabilities.
1) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-32282)
CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition
CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a local user to modify file permissions outside the intended root directory.
The vulnerability exists due to improper access control in Root.Chmod and internal/syscall/unix Fchmodat when handling a chmod operation on Linux. A local user can replace the target with a symlink during the check-and-operation window to modify file permissions outside the intended root directory.
Exploitation requires a race condition in which the target is swapped with a symlink while the chmod operation is in progress.
2) Use of uninitialized resource (CVE-ID: CVE-2026-32814)
CWE-ID: CWE-908 - Use of Uninitialized Resource
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to use of uninitialized resource in ImageItem_Grid::decode_and_paste_tile_image() in libheif/image-items/grid.cc when decoding a crafted HEIF or AVIF grid image with strict_decoding=false. A remote attacker can supply a specially crafted file with a corrupted tile to disclose sensitive information.
User interaction is required to process the crafted file, and the issue occurs with the default decoding behavior where tile decode failures are returned as success.
Remediation
Install update from vendor's website.