libheif, a widely used HEIF/AVIF decoder and encoder, contains a flaw that allows an attacker to trigger unbounded heap allocations. The sequence parser in fixed‑size mode fails to limit the sample_count parameter when parsing an HEIF sequence with the msf1 brand, so the library can be instructed to allocate gigabytes of memory. Additionally, the Track::load function performs 32‑bit arithmetic when adding current_sample_idx and samples_per_chunk, enabling a wraparound that bypasses the consistency check. These issues permit the allocation of excessive memory in the Chunk constructor, leading to out‑of‑memory crashes or process stalls. The vulnerability is categorized as an integer overflow (CWE‑190) and an unbounded array allocation (CWE‑770).

The vulnerability affects strukturag libheif versions from 1.19.0 up to, but not including, 1.23.0. Applications or services that integrate these library versions and process untrusted HEIF files are potentially impacted. Versions 1.23.0 and later contain the fix and are not affected.

The CVSS score is 7.5, indicating a highly severe impact. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Attackers can trigger the flaw by supplying a carefully crafted HEIF file with a malicious sample_count and msf1 brand. The exploit requires the target to successfully parse such a file, which can be achieved in any context where the application accepts or decodes HEIF images from external sources. The exploit is local to the process running libheif but can lead to a denial of service or potential system instability through uncontrolled memory consumption.