The vulnerability is a heap out‑of‑bounds read in libheif triggered by an unsigned integer underflow when parsing the stsc box of a HEIF file whose samples_per_chunk value is zero. The underflow causes all samples to be mapped to an empty chunk, and subsequent sample access reads from index zero of an empty std::vector, leading to a segmentation fault. The HEIF file is parsed without error, but the crash occurs when the first frame is accessed, resulting in a denial‑of‑service.

The affected product is libheif, developed by strukturag. Versions 1.21.2 and earlier are vulnerable; the issue was fixed in version 1.22.0.

The CVSS score of 6.5 reflects a moderate severity vulnerability. EPSS data is unavailable and the vulnerability is not listed in the CISA KEV catalog, indicating no widespread exploitation has been observed yet. The likely attack vector is a crafted HEIF file supplied to any software that uses libheif for decoding. If such software does not validate or sandbox image handling, the malicious file can trigger a crash and deny service to the process or application. The risk level is moderate to high for systems that process untrusted image data.