The vulnerability arises when CHEIFItemInfoEntry_GetDataSize reports success but supplies a data size of zero, causing a caller to allocate only one byte. Subsequently, CopyPixels computes a larger destination size but fails to validate that the source buffer contains enough data before calling memmove, resulting in a buffer over‑read. This flaw permits an attacker to read beyond the bounds of the source image data, potentially exposing sensitive memory contents or causing a crash. The weakness corresponds to a buffer over‑read (CWE‑20).

Microsoft HEIF Image Extensions 1.2.22.0 on Windows platforms is affected. The flaw is present in the HEIF Image Extensions component and affects any system that uses that specific version to process HEIF images.

The exploitation of this vulnerability requires an attacker to deliver a crafted HEIF image to a user or application that loads the image. Because the flaw is an out‑of‑bounds read, it could lead to information disclosure or memory corruption; however, no publicly available exploit is known and no CVSS score is provided. The risk level is moderate to high depending on the context (local or remote access) and the sensitivity of the data processed by HEIF Image Extensions. The vulnerability is not currently listed in CISA KEV, and no EPSS score is available, so the precise likelihood of exploitation is unknown.