The vulnerability is a heap-buffer-overflow that occurs during normal HEIF/AVIF decoding when a 1×4 grid of odd‑height tiles is processed. The fault writes 64 attacker‑controlled bytes past the end of a chroma plane allocation, enabling full control over the overwritten memory. Such overwrite can corrupt memory, crash the application, or possibly allow execution of arbitrary code if the overflow reaches executable code paths. The weakness is a classic example of CWE‑787, where data written outside the bounds of an allocated heap buffer occurs during regular library usage with default build configuration.

The affected software is libheif from strukturag, the HEIF and AVIF encoder/decoder. All releases up to and including 1.21.2 are vulnerable; the problem was fixed in version 1.22.0. No other vendors or products are listed as impacted.

The CVSS score of 8.8 indicates high severity. EPSS data is unavailable, and the vulnerability is not listed in CISA’s KEV catalog. The flaw is exploitable by supplying a crafted HEIF/AVIF file that is processed by any application that uses libheif without safeguards. A prominent attack vector is remote delivery of a malicious image—via email, a web site, or any file‑import functionality—so the risk is high for any exposed service that decodes such files. The missing EPSS score does not diminish that the stack impact could be severe if the overflow reaches executable memory.