libheif, a HEIF and AVIF format decoder and encoder, contains a null pointer dereference in the public API function heif_image_handle_get_image_tiling(). The flaw is triggered when a malformed uncompressed HEIF image includes an uncC property but omits the required ispe property. In such cases the library reads a null pointer, leading to a crash; debug builds trigger an assertion, while release builds dereference address 0xa8. The defect, a result of missing null‑check handling, is classified as CWE‑476.

strukturag libheif versions prior to 1.22.0 are affected. Any application that statically or dynamically links against these versions of the library and processes HEIF files received from untrusted sources is vulnerable.

The CVSS score of 6.9 indicates a moderate severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by supplying a crafted HEIF file lacking an "ispe" property to an application using the vulnerable library, causing that application to crash and resulting in a denial of service.