CVE-2026-32738
MediumAdvisory
Published 19 May 2026In the index since 5 Sept 2026
- Severity
- Medium
- worst across findings
- CVSS
- 6.5
- base score, highest
- EPSS
- 0.003
- 23rd percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 152
- of 17,781 indexed, latest versions
- Container images
- 162
- deployed by those charts
- Fix available
- 2 of 2
- affected packages
The matching OSV records carry no description.
Carried by container images the latest versions of 152 of 17,781 indexed charts deploy, on 162 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| libheifdeb | 1.15.1-1, 1.15.1-1+deb12u1, 1.20.2-1 | 1.20.2-1ubuntu0.4 | 156 |
| libheifapk | 1.21.2-r0 | 1.23.0-r0 | 6 |
- OSV records
- ALPINE-CVE-2026-32738DEBIAN-CVE-2026-32738UBUNTU-CVE-2026-32738
- Also known as
- USN-8454-1
Charts affected
152 by stars
Container images carrying it
162 by charts deploying them
A fixed version is listed for 2 of the 2 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| jhoncytech/ | 18c3ca1f411e | libheif | no fix listed | 1 |
| jordan/ | f75025fe8ea8 | libheif | no fix listed | 1 |
| juicedata/ | 95008ba63318 | libheif | no fix listed | 1 |
| knspar/ | 0c4f0543ee58 | libheif | no fix listed | 1 |
| kuzwolka/ | 1ad759b961b1 | libheif | no fix listed | 1 |
| kuzwolka/ | 3e8880fbbb96 | libheif | no fix listed | 1 |
| kuzwolka/ | 4a7707410bf1 | libheif | no fix listed | 1 |
| kuzwolka/ | 84a9d9766345 | libheif | no fix listed | 1 |
| laly9999/ | dd0e503913e1 | libheif | no fix listed | 1 |
| langflowai/ | 54f67f1961fe | libheif | no fix listed | 1 |
| library/ | 588609d76b21 | libheif | no fix listed | 1 |
| library/ | 09369da6b103 | libheif | no fix listed | 1 |
| library/ | 6784fb0834aa | libheif | no fix listed | 1 |
| library/ | 67f9a4f10d14 | libheif | no fix listed | 1 |
| library/ | 9ff236ed47fe | libheif | no fix listed | 1 |
| library/ | fb197595ebe7 | libheif | no fix listed | 1 |
| library/ | 8f693eaa7e0a | libheif | no fix listed | 1 |
| library/ | d41127070014 | libheif | no fix listed | 1 |
| library/ | 8ae66efb09a2 | libheif | no fix listed | 1 |
| logiqai/ | 65b996bc7bdc | libheif | no fix listed | 1 |
| makersquad/ | a40dd258c527 | libheif | no fix listed | 1 |
| martinhelmich/ | c83a4f3fd7ae | libheif | no fix listed | 1 |
| mathesar/ | 091757cb01fe | libheif | no fix listed | 1 |
| mintproject/ | 02260d20a21f | libheif | no fix listed | 1 |
| moreillon/ | d7d4a5463525 | libheif | no fix listed | 1 |
| moreillon/ | e418cc694bd5 | libheif | no fix listed | 1 |
| moreillon/ | e8fd856e593d | libheif | no fix listed | 1 |
| moreillon/ | 3caa8f710ee0 | libheif | no fix listed | 1 |
| moreillon/ | 6597e6b98d21 | libheif | no fix listed | 1 |
| moreillon/ | d2ee0423b797 | libheif | no fix listed | 1 |
| muhammedgamal/ | 74b4cd69b6fa | libheif | no fix listed | 1 |
| nirmalnaveen/ | 8541a39162f3 | libheif | no fix listed | 1 |
| opea/ | 2bee4eb66f3e | libheif | no fix listed | 1 |
| opea/ | 3ef121f34610 | libheif | no fix listed | 1 |
| opea/ | 7f854e9bffaf | libheif | no fix listed | 1 |
| openbas/ | a277796d9724 | libheif | no fix listed | 1 |
| openproject/ | 88dc1359dfb5 | libheif | no fix listed | 1 |
| phan2410/ | 9c6ed6de26ca | libheif | no fix listed | 1 |
| phan2410/ | 4a86d138832d | libheif | no fix listed | 1 |
| photoprism/ | db16ee6b1ba3 | libheif | 1.20.2-1ubuntu0.4 | 1 |
| pk910/ | 3dcae6a62896 | libheif | no fix listed | 1 |
| praravind1801/ | f29d637b9ce1 | libheif | no fix listed | 1 |
| rocketadmin/ | 10955ef540b9 | libheif | no fix listed | 1 |
| santisbon/ | c4e994ca4540 | libheif | no fix listed | 1 |
| santisbon/ | e807283f8d69 | libheif | no fix listed | 1 |
| santisbon/ | 8ee3a1697227 | libheif | no fix listed | 1 |
| sashafefler/ | f96d7804c0ca | libheif | no fix listed | 1 |
| sbs20/ | dad1fd6e9a98 | libheif | no fix listed | 1 |
| shamimkuet/ | b82902a76a04 | libheif | no fix listed | 1 |
| signalen/ | 760256000738 | libheif | no fix listed | 1 |