The vulnerability is an out‑of‑bounds read in the vvdec_push_data2 function of the HEIF File Parser component in libheif. An attacker manipulating the size argument can cause the function to read memory beyond the intended bounds, potentially exposing sensitive data. The weakness is categorized as CWE‑119, CWE‑125, and CWE‑805. No code execution or denial of service is reported; the primary impact is information disclosure when the library processes a crafted HEIF file.

This flaw exists in strukturag libheif versions up to 1.21.2, affecting the decoder_vvdec.cc source file. The vulnerable code path resides in the HEIF File Parser plugin. Systems running any of these versions that accept HEIF images from untrusted sources are susceptible.

The CVSS score is 4.8, indicating moderate severity, while the EPSS score is below 1 %, suggesting a low probability of widespread exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires local execution; the attacker must run code on the target system or supply a malicious HEIF file that the local user or application processes. Public proof‑of‑concepts exist on GitHub, confirming that the flaw can be exercised in practice. Although the risk is limited to environments that process untrusted HEIF files locally, the impact of information leakage warrants prompt remediation.