libheif, a HEIF and AVIF file format decoder and encoder, has a heap out‑of‑bounds write in versions 1.19.0 through 1.21.2 when processing a specially crafted HEIF file that uses the uncompressed unci codec in a tiled, component‑interleaved 4:2:0 layout. The vulnerability causes a write beyond the bounds of the tile buffer, overwriting the vtable pointer of an adjacent unc_decoder_component_interleave object. When the next virtual method call occurs, control can be redirected to an attacker‑chosen address, enabling remote code execution. The flaw is classified as CWE‑787 and carries a CVSS score of 6.1.

The issue affects the libheif library developed by strukturag. Versions from 1.19.0 up to and including 1.21.2 are vulnerable; the problem was fixed in version 1.22.0 and later.

The CVSS score of 6.1 is a medium severity rating. The EPSS score is less than 1%, so exploitation is expected to be rare. The flaw has not been listed in the CISA KEV catalog. An attacker can exploit the weakness by providing a malicious HEIF file to any application that uses libheif to decode images, such as photo viewers or media players. Because the vulnerability requires a specifically crafted file and the attacker must get the library to process it locally, the attack vector is primarily local or through untrusted file uploads.