The vulnerability stems from an integer overflow (CWE-190) in libheif's inline mask parsing code within libheif/region.cc. When decoding HEIF or AVIF files, the program reads unsigned 32-bit width and height values from the file, multiplies them, and then divides by 8 to determine the mask buffer size. If the product exceeds the maximum 32-bit value, it wraps around to a small number before the division, resulting in an undersized buffer that is later accessed beyond its bounds when the mask is treated as a width × height bitmap. This flaw can lead to memory corruption or crashes, impacting the integrity or availability of the application parsing the files.

The affected product is libheif, developed by strukturag. Versions 1.21.2 and earlier are impacted, while the issue is patched starting with version 1.22.0.

The CVSS score of 6.1 indicates moderate severity. EPSS is below 1%, showing a low likelihood of exploitation, and the vulnerability is not listed in CISA KEV. The likely attack vector is the delivery of a crafted HEIF/AVIF file to an application that uses libheif to decode media. Exploitation requires file manipulation but does not necessarily allow control over the process.