The flaw is an out‑of‑bounds read and invalid dereference triggered when libheif parses a malformed HEIF sequence file. The buggy core sequence parser allows a file with stco.entry_count set to zero to bypass validation because saio.entry_count is also zero, yet SampleAuxInfoReader continues to loop when saiz.sample_count is greater than zero. The loop then dereferences chunks[0] although no chunks exist, causing a crash and denial of service. This weakness is catalogued as CWE‑125 (Out‑of‑Bounds Read) and CWE‑476 (Dereference of Null Pointer).

The issue afflicts libheif version 1.21.2 and earlier, an open‑source HEIF and AVIF decoder/encoder maintained by strukturag. Any application that links against these affected releases—including image viewers, media libraries, and server uploads—could be impacted, as the vulnerable code resides in the core sequence parsing logic common to all such uses.

The vulnerability carries a CVSS score of 6.5, indicating a moderate severity. Because EPSS data is not available, the exploitation likelihood cannot be quantified precisely, but the fact that an attacker can supply any HEIF file means the problem is readily exploitable if the target processes external uploads or content. The issue has not been added to CISA’s KEV catalog, and no public exploit is currently documented. Mitigation is to upgrade to libheif 1.22.0 or later, which removes the out‑of‑bounds dereference.