An infinite loop in the Box_stts::get_sample_duration() function is triggered by a specially crafted 800‑byte HEIF file. The loop consumes 100 % CPU for an indefinite period and never terminates or generates an error, rendering the process invisible to crash‑based monitoring tools. The vulnerability is a classic CWE‑835 Infinite Loop flaw that leads to a resource exhaustion Denial of Service before any user interaction or image rendering occurs.

The issue affects the libheif library produced by strukturag, specifically all releases 1.21.2 and older. The problem was addressed in release 1.22.0 and later versions.

The CVSS score of 6.5 indicates a moderate severity, and the EPSS score is not available. The vulnerability is not listed in CISA’s KEV catalog, reducing known widespread exploitation probability, but the lack of a termination condition makes it a persistent local DoS that can be triggered by any process that opens an untrusted HEIF file. An attacker can supply the crafted file either via direct file upload, phishing, or any mechanism that leads a service to parse the file, causing the CPU to be exhausted and the application to become unresponsive.