The vulnerability is a heap‑buffer‑overread that occurs when libheif parses a HEIF sequence file whose saiz box declares more samples than are listed in the chunks vector. The constructor of SampleAuxInfoReader iterates over the declared samples without checking that the number is supported by the actual chunks, which causes the loop to read past the end of the chunks array. This out‑of‑bounds read can potentially reveal memory contents or crash the application. The flaw is a read‑side buffer overrun (CWE‑125).

The flaw affects libheif version 1.21.2 and all earlier releases from the vendor strukturag. Applications that compile against those versions or allow untrusted HEIF files to be processed are vulnerable. The vendor released a fix in libheif 1.22.0, which removes the missing validation and clamps sample iteration to the bounds of the chunks vector.

The CVSS score of 5.1 indicates moderate severity. The EPSS is not available, so the exploitation probability is unknown, but the issue is not listed in CISA KEV. The vulnerability is triggered during file parsing by heif_context_read_from_file, and no further interaction is required. An attacker who can supply an arbitrary HEIF file to a vulnerable application can trigger the overread directly, potentially exposing sensitive data or causing a crash. The security impact therefore depends on the application's sensitivity to accidental memory leaks or availability loss, and it is most relevant to systems that accept HEIF uploads from untrusted sources.