libheif introduced a new security check to address an earlier integer‑overflow flaw, but the check itself contains an integer overflow that can be bypassed by feeding a crafted HEIF file with a VVC track. This bypass re‑enables the same out‑of‑bounds heap read that the original CVE targeted, potentially leaking memory contents or crashing the application. The flaw is an integer overflow (CWE‑190) leading to an out‑of‑bounds read (CWE‑125). The fix was not tested for sizes near UINT32_MAX, and version 1.22.0 is the first release that includes the correct patch.

The affected product is strukturag libheif. Versions released prior to 1.22.0 contain the vulnerable code. Version 1.22.0 and later incorporate the necessary patch to eliminate the overflow. No other vendors or products are listed.

The EPSS score is below 1 % and the vulnerability has not been listed in the CISA KEV catalog, implying a low probability of widespread exploitation. Exploitation requires an application that processes HEIF files, and more specifically those with VVC tracks, enabling an attacker to supply a crafted file. Given the CVSS score of 6.8, the potential impact is limited but real for systems that decode untrusted media. The likely attack vector is via the file decoding path, potentially allowing local or remote exploitation depending on how libheif is used.